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APPENDIX B - Initial Regulatory Flexibility Analysis 


I. INTRODUCTION 


1. The Commission plays an important role in protecting the security of America’s 
communications networks. Recently, the Commission, Congress, and the Executive Branch have taken 
action to protect the supply chain of equipment and services within the United States. The Commission, 
in particular, has taken a number of targeted steps to ensure that public funds are not used in a way that 
undermines or poses a threat to our national security. 


2. Today, we build on those efforts. In this proceeding, consistent with concurrent 
Congressional and Executive Branch actions, we explore steps we can take to further the Commission’s 
goal of protecting our communications networks from communications equipment and services that pose 
a national security risk or a threat to the safety of U.S. persons beyond the Commission’s universal 
service programs. Specifically, we propose that the Commission’s rules related to equipment 
authorization and our competitive bidding procedures also can play an important role in securing our 
nation’s critical communications networks, and we seek comment on how we should review and revise 
these processes for this purpose. Our action is guided by the belief that the Commission must do all it can 
within its legal authority to address national security threats. 


3. In particular, in the Notice of Proposed Rulemaking (Notice), we propose prohibiting the 
authorization of any communications equipment on the list of equipment and services (Covered List) that 
the Commission maintains pursuant to the Secure and Trusted Communications Networks Act of 2019.! 
Such equipment has been found to pose an unacceptable risk to the national security of the United States 
or the security and safety of United States persons. We also seek comment on whether and under what 
circumstances we should revoke any existing authorizations of such “covered” communications 
equipment. Finally, we invite comment on whether we should require additional certifications relating to 
national security from applicants who wish to participate in Commission auctions. In the Notice of 
Inquiry, we seek comment on other actions the Commission should consider taking to create incentives in 
its equipment authorization processes for improved trust through the adoption of cybersecurity best 
practices in consumer devices. 


4. The Commission has reviewed and revised its equipment authorization and competitive 
bidding processes through the years to meet the challenges of an evolving ecosystem. While we are 
proposing action in this Notice to leverage these processes to help keep untrusted vendors and equipment 
out of U.S. networks, the Commission also is taking action to review and revise these processes to spur 
trustworthy innovation that can advance the nation’s global competitiveness and promote responsible 
global development and deployment. We are doing so by streamlining equipment authorization so that 
the American public can benefit more quickly from new and more advanced communications systems that 
rely on this equipment, while still ensuring that the important goals of the equipment authorization system 
and security are not undermined.? Together, these actions advance the Commission’s comprehensive 
strategy to help build a more secure, resilient, and next-generation communications supply chain. 


II. BACKGROUND 


By In this Notice of Proposed Rulemaking and Notice of Inquiry, we build upon the 
Commission’s efforts to reduce the presence of untrusted equipment in United States communications 


' Secure and Trusted Communications Networks Act of 2019, Pub. L. No. 116-124, 133 Stat. 158 (2020) (codified 
as amended at 47 U.S.C. §§ 1601—1609) (Secure Networks Act). The Commission’s Public Safety and Homeland 
Security Bureau (PSHSB) maintains the list at https://www.fcec.gov/supplychain/coveredlist. 


? Allowing Earlier Equipment Marketing and Importation Opportunities, ET Docket No. 20-382, Report and Order, 
FCC 21-xxx (June 17, 2021) (adopting targeted enhancements that will modernize the Commission’s marketing and 
importation rules to allow equipment manufacturers to better gauge consumer interest and prepare for new product 
launches in order to further the communication’s sector’s ability to drive innovation and promote economic growth). 


10579 


Federal Communications Commission FCC 21-73 


networks. In this Background section, we begin by discussing the Commission’s actions to date, which 
recently have culminated in new rule provisions to promote more secure networks along with the 
publication, in March of this year, of a list of “covered” communications equipment and services that 
have been deemed to pose an unacceptable risk to the national security of the United States or the security 
and safety of United States persons. We then discuss the Commission’s part 2 equipment authorization 
tules and processes through which the Commission authorizes equipment for operation in the United 
States. The Commission’s current rules do not yet include provisions that address the authorization of 
such “covered” equipment. Finally, we review how application certifications required by the 
Commission’s part 1 competitive bidding rules serve to protect against the risk of future harms to the 
public interest and how such certifications might be used to mitigate the risks to U.S. communications 
networks and services. 


A. Recent Commission Actions, as well as Congressional and Executive Branch 
Actions, to Protect the Security of our Nation’s Communications System 


6. At an increasingly rapid pace in recent years, the United States government has moved to 
protect the security of the communications networks across our nation. Congress and the Executive 
Branch have prioritized the importance of identifying and eliminating potential security vulnerabilities in 
communications networks and their supply chains. The Commission, which was created by Congress in 
part “for the purpose of the national defense [and] for the purpose of promoting safety of life and property 
through the use of wire and radio communication . . . ,”> in turn has helped to identify and address these 
vulnerabilities by using its resources in taking various actions to protect the integrity of communications 
networks and the communications supply chain. 


7. Congressional and Executive Branch Action Prior to the Secure and Trusted 
Communications Networks Act of 2019. Over the years, both Congress and the Executive Branch have 
taken numerous actions to identify and address threats to our nation’s communications systems posed by 
certain communications equipment. In 2013, the White House issued Executive Order 13636, which 
directed the National Institute of Standards and Technology (NIST) to begin working with stakeholders to 
develop a voluntary cybersecurity framework designed to reduce risks to critical infrastructure.6 In May 


3 “Public Safety and Homeland Security Bureau Announces Publication of the List of Equipment and Services 
Covered by Section 2 of the Secure Networks Act,” WC Docket No. 18-89, Public Notice, DA 21-309 (PSHSB, 
Mar. 12, 2021) (Covered List Public Notice), see 47 CFR § 1.50002. 


4 In 2012, the House Permanent Select Committee on Intelligence released a bipartisan report assessing the 
counterintelligence and security threat posed by Chinese telecommunications companies operating in or providing 
equipment to customers in the United States. Permanent Select Committee on Intelligence, U.S. House of 
Representatives, Investigative Report on the U.S. National Security Issues Posed by Chinese Telecommunications 
Companies Huawei and ZTE at iv (Oct. 8, 2012), https://republicans-intelligence.house.gov/sites/intelligence 
-house.gov/files/documents/huaweizte%20investigative%20report%20(final).pdf. In November 2018, the 
Department of Homeland Security convened the Information and Communications Technology Supply Chain Risk 
Management Task Force, a public-private partnership formed to examine and develop consensus recommendations 
to identify and manage risk to the global information and communications supply chain. Press Release, Department 
of Homeland Security, DHS Announces ICT Supply Chain Risk Management Task Force Members (Nov. 15, 
2018), https://www.dhs.gov/news/2018/1 1/15/dhs-announces-ict-supply-chain-riskmanagement-task-force- 
members. In 2020, the Department of Defense explained its strategic objective for supply chain security is to 
“[r]educe threats to key U.S. supply chains to prevent foreign attempts to compromise the integrity, trustworthiness, 
and authenticity of products and services purchased and integrated into the operations of the U.S. Government, the 
Defense Industrial Base, and the private sector.” The National Counterintelligence and Security Center, Supply 
Chain Risk Management: Reducing Threats to Key U.S. Supply Chains (Sept. 25, 2020), 
https://www.dni.gov/files/NCSC/documents/supplychain/20200925-NCSC-Supply-Chain-Risk-Management-tri- 
fold.pdf. 


547 U.S.C. § 151. 
6 Exec. Order No. 13636, 78 Fed. Reg. 11737 (Feb. 19, 2013). 
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2017, the White House released Executive Order 13800, which directed the Secretary of Homeland 
Security, in coordination with the Secretary of Defense, the Attorney General, the Director of National 
Intelligence, the Director of the Federal Bureau of Investigation, and all other appropriate agency heads, 
to identify authorities and capabilities that agencies could employ to support the cybersecurity efforts of 
critical infrastructure entities, and to determine how best to support cybersecurity risk management 
efforts.’ 


8. In December 2017, Congress enacted the National Defense Authorization Act for Fiscal 
Year 2018 (2018 NDAA), which included provisions that addressed continuing concerns over the 
purchase and use of certain communications equipment, specifically barring the Department of Defense 
from using telecommunications equipment or services produced or provided by Huawei Technologies 
Company (Huawei) or ZTE Corporation (ZTE) for certain critical programs, including ballistic missile 
defense and nuclear command, control, and communications.* In August 2018, Congress enacted the 
National Defense Authorization Act for Fiscal Year 2019 (2019 NDAA),° which, pursuant to Section 
889(b)(1) prohibits the head of an Executive Branch agency from using federal funds to procure or obtain 
equipment, services, or systems that use “covered telecommunications equipment or services” as a 
substantial or essential component of any system, or as critical technology as part of any system. !° 
Section 889(f)(3) of the 2019 NDAA subsequently and generally defines “covered telecommunications 
equipment or services” as (1) telecommunications equipment produced by Huawei or ZTE or any 
subsidiary or affiliate of such entities; (2) for certain safety and security purposes, video surveillance and 
telecommunications equipment produced by Hytera Communications Corporation (Hytera), Hangzhou 
Hikvision Digital Technology Company (Hikvision), or Dahua Technology Company (Dahua) or any 
subsidiary or affiliate of such entities; (3) telecommunications or video surveillance equipment services 
provided by such entities or using such equipment; or (4) telecommunications or video surveillance 
equipment or services produced by an entity that the Secretary of Defense, in consultation with the 
Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably 
believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered 
foreign country, where “covered foreign country” is defined as the People’s Republic of China.!! 


9. In December 2018, Congress enacted the SECURE Technology Act to create the Federal 
Acquisition Security Council, which includes seven Executive Branch agencies.'? The Council is charged 
with developing a government-wide strategy to address communications supply chain risks and may 
recommend that other agencies remove unsecure communications services or equipment.!? In May 2019, 
the White House issued Executive Order 13873, declaring a national emergency with respect to the 
security, integrity, and reliability of information and communications technology and services, and 
granting the Secretary of Commerce the authority to prohibit transactions of information and 
communications technology or services when, among other things, the transaction would pose undue risks 


7 Exec. Order No. 13800 § 2(b), 82 Fed. Reg. 22391, 22393, Strengthening the Cybersecurity of Federal Networks 
and Critical Infrastructure (May 11, 2017). 


8 See Pub. L. 115-91, 131 Stat. 1283, 1762, § 1656. 
° See Pub. L. 115-232, 132 Stat. 1636. 

10 Jd. at 1917, § 889(a)-(b)(1). 

11 Jd. at 1918, § 889(£)(2)-(3). 

12 See Pub. L. 115-390, 132 Stat. 5173. 

13 See id. 
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to U.S. critical infrastructure or national security.'4 In November 2019, the Department of Commerce 
began a rulemaking to implement Executive Order 13873.!> 


10. Commission Action Prior to Enactment of the Secure and Trusted Communications 
Networks Act of 2019. In 2018, the Commission took new steps to protect communications networks and 
supply chains from communications equipment and services that could pose a national security risk. In 
April 2018, the Commission adopted a new proceeding, WC Docket No. 18-89, and proposed to prohibit 
the use of Universal Service Fund (USF) support to purchase or obtain equipment or services from any 
communications equipment or service provider identified as posing a national security risk to 
communications networks or the communications supply chain.'* In November 2019, the Commission 
adopted the Supply Chain Report and Order, Further Notice, and Order, in which it adopted a rule 
prohibiting the use of “universal service support . . . to purchase or obtain any equipment or services 
produced or provided by a covered company posing a national security threat to the integrity of 
communications networks or the communications supply chain.”!7 The Commission also initially 
designated two Chinese companies, Huawei and ZTE, and their subsidiaries, parents, or affiliates, as 
companies that pose a national security threat to the integrity of communications networks and the 
communications supply chain, and we established a process to finalize these initial designations and to 
issue future designations of other companies posing such a risk.!8 Consistent with that process,!? the 
Commission’s Public Safety and Homeland Security Bureau issued final designations of Huawei and ZTE 
on June 30, 2020,” which immediately precluded use of USF support to purchase, maintain, improve, 


14 See Exec. Order No. 13873, 84 Fed. Reg. 11578, Executive Order on Securing the Information and 
Communications Technology and Services Supply Chain (May 15, 2019), 
https://www.federalregister.gov/documents/2019/05/17/2019-10538/securing-the-information-and-communications- 
technology-and-services-supply-chain (Executive Order 13873). On May 14, 2020, the President issued an order 
extending the emergency declaration for another year. See Continuation of the National Emergency with Respect to 
Securing the Information and Communications Technology and Services Supply Chain, 85 Fed. Reg. 29321 (May 
14, 2020). 


15 U.S. Department of Commerce, Securing the Information and Communications Technology and Services Supply 
Chain, 84 Fed. Reg. 65316 (Nov. 27, 2019). 


16 See Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs, 
WC Docket No. 18-89, Notice of Proposed Rulemaking, 33 FCC Red 4058, 4058, para. 2 (2018) (Supply Chain 
Notice). 


17 Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs, WC 
Docket No. 18-89, Report and Order, Further Notice of Proposed Rulemaking, and Order, 34 FCC Red 11423, 
11433, para. 26 (2019) (Supply Chain Order and Further Notice), appeal pending in Huawei Technologies USA v. 
FCC, No. 19-60896 (5th Cir.). The Commission adopted this rule based on its conclusion that it is critical to the 
provision of “quality service,” 47 U.S.C. § 254(b)(1), that USF support be spent on secure networks and not on 
equipment and services from companies that threaten national security. Pursuant to this rule, which is codified at 47 
CFR § 54.9, USF support may not be used to purchase, maintain, improve, modify, operate, manage, or otherwise 
support any equipment or services produced or provided by a covered company. 


18 See Supply Chain Order, 34 FCC Red at 11438-48, paras. 43-63. 


19 See Supply Chain Order, 34 FCC Rcd at 11438, para. 40; id. at 11449, para. 64; id. at 11486, para. 185 (directing 
the Public Safety and Homeland Security Bureau to determine whether to finalize the initial designations within 120 
days of the Order’s publication in the Federal Register, and holding that the Bureau may extend the 120-day 
deadline for good cause); Public Safety and Homeland Security Bureau Extends Timeframe For Determining 
Whether to Finalize Designations of Huawei and ZTE Pursuant to 47 CFR § 54.9, PS Docket Nos. 19-351 and 19- 
352, Public Notice, 35 FCC Red 4515 (PSHSB 2020) (finding good cause to extend the timeframe for determining 
whether to finalize the initial designations of Huawei and ZTE to June 30, 2020). 


20 See generally Protecting Against National Security Threats to the Communications Supply Chain Through FCC 

Programs — Huawei Designation, PS Docket No. 19-351, Order, 35 FCC Red 6604 (PSHSB 2020) (Huawei 

Designation Order); Protecting Against National Security Threats to the Communications Supply Chain Through 
(continued. ...) 
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modify, operate, manage, or otherwise support any equipment or services produced or provided by 
Huawei or ZTE or their subsidiaries, parents, or affiliates.?! 


11. The Commission also has taken action, by authority of section 214 of the 
Communications Act, to protect our communications networks.?? In 2019, the Commission declined to 
grant China Mobile’s application for a section 214 authorization to provide international 
telecommunications services between the U.S. and foreign destinations because it concluded that the 
company was “vulnerable to exploitation, influence, and control by the Chinese government.” Relying 
on the expertise of appropriate Executive Branch agencies, the Commission concluded that there existed 
“a significant risk that the Chinese government would use the grant of such authority to [the carrier] to 
conduct activities that would seriously jeopardize the national security and law enforcement interests of 
the United States.”** In 2020 and 2021, the Commission began considering whether other carriers 
affiliated with the Chinese government that hold international section 214 authority should continue to be 
authorized to provide telecommunications service in the United States.” 


12. Secure and Trusted Communications Networks Act of 2019. On March 12, 2020, the 
President signed into law the Secure and Trusted Communications Networks Act of 2019 (the Secure 
Networks Act).26 The Secure Networks Act intersects with several key provisions of the Commission’s 


FCC Programs — ZTE Designation, PS Docket No. 19-352, Order, 35 FCC Red 6633 (PSHSB 2020) (ZTE 
Designation Order). 


21 In the Supply Chain Further Notice portion, the Commission sought comment on a proposal to “require, as a 
condition on the receipt of any USF support that Eligible Telecommunications Carriers [ETCs] not use or agree not 
to use within a designated period of time, communications equipment or services from covered companies.” Supply 
Chain Order, 34 FCC Red at 11470-71, para. 122. It also proposed to establish a program to reimburse costs 
incurred by ETCs required to remove and replace covered equipment and services. Id. To better inform the 
Commission’s consideration of a reimbursement program and the presence of Huawei and ZTE equipment in U.S. 
networks, the Jnformation Collection Order portion of its decision, which required ETCs to report whether they use 
or own Huawei or ZTE equipment or services in their networks, or the networks of their affiliates and subsidiaries, 
and to report the cost of removing and replacing such equipment and services. Jd. at 11481-82, paras. 162-63. The 
Commission released the results of that information collection in September 2020. See Wireline Competition 
Bureau and Office of Economics and Analytics Release Results from Supply Chain Security Information Collection, 
WC Docket No. 18-89, Public Notice, 35 FCC Red 9471 (WCB 2020) (Information Collection Results PN). 


22 47 U.S.C. § 214(a) (“No carrier shall undertake the construction of a new line or an extension of any line, or shall 
acquire or operate any line, or extension thereof, or shall engage in transmission over or by means of such additional 
or extended line, unless and until there shall first have been obtained from the Commission a certificate that the 
present or future public convenience and necessity require or will require the construction, or operation, or 
construction and operation, of such additional or extended line . . . .”); see also China Mobile International (USA) 
Inc.; Application for Global Facilities-Based and Global Resale International Telecommunications Authority 
Pursuant to Section 214 of the Communications Act of 1934, as Amended, File No. ITC-214-20110901-00289; 
China Mobile International (USA) Inc., Memorandum Opinion and Order, 34 FCC Red 3361, 3365-66, para. 8 
(2019) (China Mobile USA Order). 


23 China Mobile USA Order, 34 FCC Rcd at 3365-66, para. 8. 
24 Id. 


235 See Pacific Networks Corp. and ComNet (USA) LLC, GN Docket 20-111, Order Instituting Proceedings on 
Revocation and Termination, FCC 21-28 (Mar. 19, 2021); China Unicom (Americas) Operations Limited, GN 
Docket 20-110, Order Instituting Proceeding on Revocation, FCC 21-37 (Mar. 19, 2021); China Telecom 
(Americas) Corporation, GN Docket No. 20-109, Order Instituting Proceedings on Revocation and Termination and 
Memorandum Opinion and Order, 35 FCC Red 15006 (2020). See also China Telecom (Americas) Corp. v. FCC, 
No. 20-2365, Order (4th Cir. May 10, 2021) (appeals court unanimously dismissing China Telecom’s challenge to 
the Commission’s decision to institute proceedings to decide whether to revoke and terminate international section 
214 authority on national security grounds, because the Commission’s decision was not a final agency action). 


76 Secure Networks Act, supra note 1. 
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Supply Chain proceeding (WC Docket No. 18-89). Section 2 of the Secure Networks Act mandates that 
the Commission publish, and periodically update, a list of “covered communications equipment and 
services” (Covered List) that have been determined to pose national security risks.”” 


13. Other provisions of the Secure Networks Act prohibit any Federal subsidy made available 
through a program administered by the Commission that provides funds used for the capital expenditures 
necessary for the provision of advanced communications service to purchase, rent, lease, or otherwise 
obtain, or maintain covered communications equipment or services (section 3) and direct the Commission 
to establish the Secure and Trusted Communications Network Reimbursement Program (section 4) and 
require providers of advanced communications service to submit annual reports to the Commission 
regarding the acquisition of covered communications equipment or services (section 5).?8 Through the 
Reimbursement Program, the Commission will reimburse eligible providers of advanced communications 
service for reasonable expenses incurred in removing, replacing, and disposing of covered equipment and 
services.” Among other things, applicants for reimbursement are required to certify that, if their 
applications are approved, “in developing and tailoring the risk management ... [they] will consult and 
consider the standards, guidelines, and best practices set forth in the cybersecurity framework developed 
by the National Institute of Standards and Technology.”*° 


27 Secure Networks Act § 2. Specifically, to be “covered,” the Secure Networks Act provides that such equipment 
must meet two criteria. First, the communications equipment or service must, based exclusively on determinations 
made by Congress, certain government agencies, or interagency bodies, “pose[] an unacceptable risk to the national 
security of the United States or the security and safety of United States persons[.]” Secure Networks Act § 2(b)(1). 
Second, the equipment or services must be “capable of — (A) routing or redirecting user data traffic or permitting 
visibility into any user data or packets that such equipment or service transmits or otherwise handles; (B) causing the 
network of a provider of advanced communications service to be disrupted remotely; or (C) otherwise posing an 
unacceptable risk to the national security of the United States or the security and safety of United States persons.” 
See id. § 2(a). 


28 Section 3 of the Secure Networks Act prohibits the use of “a Federal subsidy that is made available through a 
program administered by the Commission and that provides funds to be used for the capital expenditures necessary 
for the provision of advanced communications service” to purchase, rent, or otherwise obtain any covered 
communications equipment or services published on the list established pursuant to section 2. See Secure Networks 
Act § 3(a)(1)(A)-(B). Consistent with the Commission’s proposals in the Supply Chain Further Notice, section 4 of 
the Secure Networks Act establishes the Secure and Trusted Communications Networks Reimbursement Program 
(Reimbursement Program) to facilitate the removal, replacement, and disposal of covered communications 
equipment and services, complete with reporting and certification requirements. See id. § 4(a). Section 5 requires 
all providers of “advanced communications services” to submit annual reports to the Commission “regarding 
whether such provider has purchased, rented, leased, or otherwise obtained any covered communications equipment 
or service....” See id. § 5(a). This reporting requirement is limited to equipment or services purchased after 
August 14, 2018. See id. Section 7 tasks the Commission with enforcing the Secure Networks Act and adds 
penalties beyond those in the Communications Act and our rules for violations of section 4. See id. § 7. Section 9 
sets forth definitions of certain terms in the Secure Networks Act, including “advanced communications service” 
and “communications equipment or service.” See id. § 9. 


29 Secure Networks Act § 4(a). 


30 Secure Networks Act § 4(d)(4). Pursuant to Executive Order No. 13636, issued in February 2013), the National 
Institute of Standards and Technology (NIST) began working with stakeholders to develop a voluntary cybersecurity 
framework designed to reduce risks to critical infrastructure. Exec. Order No. 13636, 78 Fed. Reg. 11737 (Feb. 19, 
2013); see Nat’l Inst. of Standards & Tech., Cybersecurity Framework: New to Framework (last updated Sept. 23, 
2020), https://www.nist.gov/cyberframework/new-framework. This framework is “voluntary guidance, based on 
existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk.” Nat’] 
Inst. of Standards & Tech., Cybersecurity Framework: New to Framework. NIST also has developed a 
Cybersecurity for the Internet of Things (IoT) program, which “supports the development and application of 
standards, guidelines, and related tools to improve the cybersecurity of connected devices and the environments in 
which they are deployed.” Nat’! Inst. of Standards & Tech., NIST Cybersecurity for IoT Program (last updated Mar. 
19, 2021), https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program. 
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14. Recent Commission Action. In July 2020, the Commission released its Supply Chain 
Declaratory Ruling and Second Further Notice, which found that the Commission’s prohibition on the 
use of USF support to purchase, obtain, maintain, improve, modify, or otherwise support any equipment 
or services produced or provided by any company posing a national security threat to the integrity of 
communications networks or the communications supply chain, codified at 47 CFR § 54.9, “is consistent 
with and substantially implements subsection 3(a) of the Secure Networks Act, which prohibits the use of 
federal funds on certain communications equipment and services.”! In the Supply Chain Second Further 
Notice portion, the Commission sought comment on how other sections of the Secure Networks Act 
interact with the Commission’s ongoing efforts to secure the communications supply chain.?? 


15. In December 2020, the Commission adopted the Supply Chain Second Report and Order 
to take further steps toward securing our communications networks and implementing provisions of the 
Secure Networks Act that apply to Commission action directed toward securing our nation’s 
communications networks.*? A core component of that decision concerns the creation and publication of 
the Covered List. The Commission explained that, consistent with its Supply Chain Second Further 
Notice and pursuant to section 2 of the Secure Networks Act, it was required to place on the Covered List 
“any communications equipment or service that poses an unacceptable risk to the national security of the 
United States or the security and safety of United States persons based solely on one or more of the 
following determinations,” and then lists four sources for such determinations. These include: (1) “[a] 
specific determination made by any executive branch interagency body with appropriate national security 
expertise, including the Federal Acquisition Security Council;” (2) “[a] specific determination made by 
the Department of Commerce pursuant to Executive Order No. 13873 . . . relating to securing the 
information and communications technology and services supply chain;” (3) “[t]he communications 
equipment or service being covered telecommunications equipment or services, as defined in section 
889(f)(3)” of the 2019 NDAA; or (4) “[a] specific determination made by an appropriate national security 
agency.”*+ The Commission concluded that it had no discretion to disregard determinations from these 
enumerated sources, and that the Commission can accept determinations only from these four categories 
of sources.*> The Commission also noted that the “covered” equipment on the Covered List could 
identify specific pieces of equipment or include a class or category of equipment,*° and that the 


31 Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs, WC 
Docket No. 18-89, Declaratory Ruling and Second Further Notice of Proposed Rulemaking, 35 FCC Red 7821, 
7826-27, para. 20 (2020) (2020 Supply Chain Declaratory Ruling and Second Further Notice). 


32 See id. at 7828-39, paras. 23-60. 


33 Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs, WC 
Docket No. 18-89, Second Report and Order, 35 FCC Red 14284 (2020) (Supply Chain Second Report and Order). 


34 Supply Chain Second Report and Order, 35 FCC Rcd at 14311-12, para. 58 (quoting the Secure Networks Act 
§ 2(c)). The Act defines “appropriate national security agency” to include the Department of Homeland Security, 
the Department of Defense, the Office of the Director of National Intelligence, the National Security Agency, and 
the Federal Bureau of Investigation. Id. § 9(2). 


35 Supply Chain Second Report and Order, 35 FCC Red at 14312, para. 60 (citing the Secure Networks Act § 2(c) 
(“In taking action under subsection (b)(1), the Commission shall place on the list any communications equipment or 
service that poses an unacceptable risk to the national security of the United States or the security and safety of 
United States persons based solely on one or more of the following determinations . . . .”)). See also USF Chain 
Second Report and Order, 35 FCC Rcd at 14312-16, paras. 61-70. 


36 The Commission also discussed how particular determinations would be incorporated onto the Covered List. If a 
determination indicates that a specific piece of equipment or service poses an unacceptable risk to the national 
security of the United States and the security and safety of United States persons, the Commission will automatically 
include this determination on the Covered List. The Commission concluded that if an enumerated source has 
already performed the analysis on whether the equipment or service poses an unacceptable risk to the national 
security of the United States or the security and safety of United States persons as part of its determination, the only 
action the Commission needs take is to incorporate this determination onto the Covered List. The Commission 
(continued....) 
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Commission was not required to conduct a technical analysis of the equipment prior to including it on the 
Covered List.?” The Commission provided that the Public Safety and Homeland Security Bureau, 
pursuant to delegated authority, would issue the Covered List and provide updates or modifications to that 
list as appropriate,’ and that the Covered List would be published without providing notice or opportunity 
to comment.*? 


16. In the Supply Chain Second Report and Order, the Commission adopted a new rule 
section, section 1.50000 et seq., to implement the Secure Networks Act. Section 1.50002 sets forth what 
communications equipment or service the Public Safety and Homeland Security Bureau must include on 
the Covered List.*° That rule provides: \ 


§ 1.50002(b). Inclusion on the Covered List. The Public Safety and Homeland Security Bureau 
shall place on the Covered List any communications equipment or service that: 


(1) Is produced or provided by any entity if, based exclusively on the following 
determinations, such equipment or service poses an unacceptable risk to the national 
security of the United States or the security and safety of United States persons: 


(i) A specific determination made by any executive branch interagency body with 
appropriate national security expertise, including the Federal Acquisition 
Security Council established under section 1222(a) of title 41, United States 
Code; 


(ii) specific determination made by the Department of Commerce pursuant to 
Executive Order No. 13873 (3 CFR, 2019 Comp., p 317); relating to securing the 
information and communications technology and services supply chain); 


(iii) Equipment or service being covered telecommunications equipment or services, 
as defined in section 889(f)(3) of the John S. McCain National Defense 
Authorization Act for Fiscal Year 2019 (Pub. L. 115-232; 132 Stat. 1918); or 


found that its actions in this scenario are non-discretionary and ministerial; that is, if the determination is specified to 
a particular piece of communications equipment or service, the Commission has no discretion to exclude that 
determination from the Covered List. Supply Chain Second Report and Order, 35 FCC Red at 14320-21, paras. 80- 
81. The Commission noted that if interested parties seek to reverse or modify the scope of one of the 
determinations, the party should petition the source of the determination. Supply Chain Second Report and Order, 
35 FCC Red at 14324, para. 89. Meanwhile, with regard to broader determination, such as a class or category of 
communication equipment or service (e.g., “telecommunications equipment produced or provided by Huawei 
Technologies Company” or any subsidiary or affiliate), or telecommunications equipment that “is capable of (A) 
routing or redirecting user data traffic or permitting visibility into any user data or packets that such equipment or 
service transmits or otherwise handles, (B) causing the networks of a provider of advanced communications service 
to be disrupted remotely, or (C) otherwise posing an unacceptable risk to the national security of the United States or 
the security and safety of United States persons” — that broader category will be included on the Covered List. 
Supply Chain Second Report and Order, 35 FCC Rcd at 14321, paras. 82-83 (citing the Secure Networks Act §§ 
2(b)(1); 2(b)(2)(A)-(C)). The Commission noted that, by adopting this approach and continuing to be deferential to 
the enumerated sources making the determination, the Commission will continue to work closely with Executive 
Branch entities with expertise and responsibilities concerning telecommunications security, including supply chain 
security. Supply Chain Second Report and Order, 35 FCC Red at 14321, para. 83. The Commission disagreed with 
those that argued that broad or general categories of equipment should not be included on the Covered List and 
rejected the view that the specified agencies must identify particular pieces or categories of equipment that posed an 
unacceptable risk. Supply Chain Second Report and Order, 35 FCC Red at 14322, para. 84. 


37 Supply Chain Second Report and Order, 35 FCC Red at 14322, para. 85. 

38 Covered List Public Notice at 2. 

39 Supply Chain Second Report and Order, 35 FCC Rcd at 14317-19, paras. 72-78. 
40.47 CFR § 1.50002. 
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(iv) A specific determination made by an appropriate national security agency; 
(2) And is capable of: 


(1) Routing or redirecting user data traffic or permitting visibility into any user data or 
packets that such equipment or service transmits or otherwise handles; 


(11) Causing the networks of a provider of advanced communications services to be 
disrupted remotely; or 


(iii) Otherwise posing an unacceptable risk to the national security of the United 
States or the security and safety of United States persons.*! 


17. In the Supply Chain Second Report and Order, the Commission defined certain terms 
associated with the Covered List. For purposes of § 1.50002(b)(1), the Commission interpreted 
“communications equipment and service” to include “any equipment or service used in fixed and mobile 
broadband networks that provides advanced communication service, provided the equipment or service 
includes or uses electronic components.”*? In making this interpretation, the Commission determined that 
all equipment or services that include or use electronic components can be reasonably considered 
essential to broadband networks, and believed that the definition will provide a bright-line rule that will 
ease regulatory compliance and administrability.* It interpreted equipment or services “capable of” the 
specified functions in § 1.50002(b)(2)(i)-(iii) as including equipment or service that can possibly perform 
these functions, even if the subject or equipment is not ordinarily used to perform the specified 
functions.“ Finally, the Commission interpreted “advanced communications service” to mean high- 
speed, switched, broadband telecommunications capability that enables users to originate and receive 
high-quality voice, data, graphics, and video telecommunications using any technology with connection 
speeds of at least 200 kbps in either direction.* 


18. As noted above, the Secure Networks Act prohibited the use of any Federal subsidy made 
available through a program administered by the Commission that provides funds used for the capital 
expenditures necessary for the provision of advanced communications service, including all of the USF 
programs, to purchase, rent, lease, or otherwise obtain, or maintain “covered” communications equipment 
or services and directed the Commission to establish the Reimbursement Program and an application 
process for that program.* In the Supply Chain Secord Report and Order, the Commission established 
this application process in section 1.50004 of its new rules.” Among other things, applicants are required 
to certify not only that they have developed a plan for permanent removal and replacement of “covered” 
communications equipment and services, but also that they will consult and consider the standards, 
guidelines, and best practices set forth in the cybersecurity framework developed by the National Institute 
of Standards and Technology in developing and tailoring the risk management.*® 


41 47 CFR § 1.50002. 
42 Supply Chain Second Report and Order, 35 FCC Rcd at 14309, para. 52; 47 CFR § 1.50001(c). 


43 Supply Chain Second Report and Order, 35 FCC Rcd at 14309, para. 52. See also id. at 14309-10, paras. 53-54 
(rejecting more narrow interpretations). 


44 Supply Chain Second Report and Order, 35 FCC Rcd at 14322-23, para. 86. 


45 Supply Chain Second Report and Order, 35 FCC Red at 14310-11, para. 55 (noting that this interpretation had 
unanimous support in the record and is consistent with the Commission’s historic interpretation of section 706); 47 
CFR § 1.50001 (a). 


46 Secure Networks Act § 4(a). 
47 Supply Chain Second Report and Order, 35 FCC Rcd at 14334, para. 116; 47 CFR § 1.50004. 


48 Secure Networks Act § 4(d)(4). See Nat’! Inst. of Standards & Tech., Cybersecurity Framework: New to 
Framework (last updated Sept. 23, 2020), https:/Avww.nist.gov/cyberframework/new-framework. This framework 
(continued. ...) 
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19. Recent Executive Branch Actions. On September 1, 2020, the Federal Acquisition 
Security Council issued an interim final rule to “standardize processes and procedures for submission and 
dissemination of supply chain information” and “facilitate the operations of a Supply Chain Risk 
Management Task Force under the [Council].”® It also provided the “criteria and procedures by which 
the [Council] will evaluate supply chain risk.”°° On January 19, 2021, the Commerce Department 
released an interim final rule with regard to Executive Order 13873, which gave the Secretary of 
Commerce authority to prohibit transactions of information and communications technology or services 
when, among other things, the transaction would pose undue risks to U.S. critical infrastructure or 
national security.*! 


20. On February 24, 2021, the President issued Executive Order 14017, which reiterates the 
importance of securing United States’ supply chains from cyberattacks and other threats to national 
security. The President affirmed that the “United States needs resilient, diverse, and secure supply chains 
to ensure our economic prosperity and national security.”>? Noting that “close cooperation on resilient 
supply chains with allies and partners who share our values will foster collective economic and national 
security,” this Order directs Executive Branch agencies to produce reports within 100 days to identify 
risks and recommendations for how to address those risks in the supply chains for various products — 
including semiconductors and rare earth elements, both of which are vital to modern communications 
technologies. The Order also directs these agencies to produce reports within one year on the supply 
chains for specific sectors and subsectors, such as information and communications technologies (ICT), 
“including the industrial base for the development of ICT software, data, and associated services.”*4 


21. On May 12, 2021, the President issued Executive Order 14028, which seeks to improve 
the nation’s cybersecurity in various ways.°> The Order begins by emphasizing that the United States 
“faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, 
private sector, and ultimately the American people’s security and privacy.’*° Among other things, this 
Order directs the Secretary of Commerce to work through the Director of NIST to “initiate pilot programs 
informed by existing consumer product labeling programs to educate the public on the security 
capabilities of Internet-of-Things (IoT) devices and software development practices, and ... consider 
ways to incentivize manufacturers and developers to participate in these programs.”>’ This process will 


is “voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and 
reduce cybersecurity risk.” Nat’l Inst. of Standards & Tech., Cybersecurity Framework: New to Framework. NIST 
also has developed a Cybersecurity for the Internet of Things (IoT) program, which “supports the development and 
application of standards, guidelines, and related tools to improve the cybersecurity of connected devices and the 
environments in which they are deployed.” Nat’! Inst. of Standards & Tech., NIST Cybersecurity for IoT Program 
(last updated Mar. 19, 2021), https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program. 


.° Office of Management and Budget, Federal Acquisition Supply Chain Security Act, 85 Fed. Reg. 54263 (Sept. 1, 
2020). 


50 Td. 


51 U.S. Department of Commerce, “Securing the Information and Communications Technology and Services Supply 
Chain,” Interim Final Rule, https://www.federalregister.gov/documents/2021/01/19/2021-01234/securing-the- 
information-and-communications-technology-and-services-supply-chain. 


52 Exec. Order No. 14017, Executive Order on America’s Supply Chains, 86 Fed. Reg. 11849 (Feb. 24, 2021), 
https://www. govinfo.gov/content/pkg/FR-2021-03-01/pdf/2021-04280.pdf. 


3 Td. 


54 Td. We note that since the Commission is an independent agency, it is not included within the scope of this Order. 


55 Exec. Order No. 14028, Executive Order on Improving the Nation’s Cybersecurity, 86 Fed. Reg. 26633 (May 17, 
2021). 


56 Id. 86 Fed. Reg. at 26633, Section 1. 
57 Td. at 26640, Section 4(s). 
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take place over the course of the next 12 months, in coordination with the Chair of the Federal Trade 
Commission and representatives from other agencies as deemed appropriate by the Director of NIST,** 
ultimately resulting in a report to the President reviewing the progress made and any “additional steps 
needed to secure the software supply chain.” Most recently, on June 2, 2021, the President issued 
Executive Order 14032 expanding the scope of Executive Order 13959, which concerns certain 
prohibitions on the purchase or sale of publicly traded securities related to surveillance technologies that 
are associated with specified entities and constitute unusual and extraordinary threats to the national 
security, foreign policy, and economy of the United States.” 


22. March 2021 Publication of Covered List Specifying “Covered” Equipment and Services. 
On March 21, 2021, the Public Safety and Homeland Security Bureau (PSHSB) published the Covered 
List identifying the covered equipment and services that specific, enumerated sources have deemed to 
pose an unacceptable risk to the national security of the United States or the security and safety of United 
States persons.°! Pursuant to section 1.50002 of the Commission’s rules, this Covered List identified 
certain telecommunications equipment and services produced or provided by Huawei Technologies 
Company and ZTE Corporation, and video surveillance and telecommunications equipment and services 
produced or provided by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology 
Company, and Dahua Technology Company — and their respective subsidiaries and/or affiliates. The 
Commission tasked PSHSB with ongoing responsibilities for monitoring the status of the determinations 
and periodically updating the Covered List to address changes as appropriate.® 


B. The Commission’s Equipment Authorization Program 


23. The Commission’s equipment authorization rules play a critical role in enabling the 
Commission to carry out its responsibilities under the Communications Act. Under Section 302 of the 
Communications Act, the Commission is authorized to make reasonable regulations governing the 
interference potential of devices that emit radiofrequency (RF) energy and that can cause harmful 
interference to radio communications.“ The purpose of the equipment authorization rules also is to 
promote efficient use of the radio spectrum and carry out various responsibilities associated with certain 
treaties and international regulations. The Commission uses the equipment authorization program, 
codified in part 2 of our rules, to ensure that RF devices in the United States comply with the 
Commission’s technical and equipment authorization requirements before they can be marketed in or 


58 Jd. at 26640-41, Section 4(t)-(w). 
5 Id. at 26641, Section 4(x). 


60 Exec. Order No. 14032, Executive Order on Addressing the Threat from Securities Investments that Finance 
Certain Companies of the People’s Republic of China, 86 Fed. Reg. 30145 (June 7, 2021). 

https://www. govinfo. gov/content/pkg/FR-202 1 -06-07/pdf/2021-12019.pdf. We note that this Executive Order 
replaces two previous Executive Orders, the November 12, 2020 Executive Order 13959 and January 13, 2021 
Executive Order 13974, that concern the same subject. See Exec. Order 13959, Addressing the Threat from 
Securities Investments That Finance Communist Chinese Military Companies, 85 Fed. Reg. 73185; Exec. Order 
13974, Amending Executive Order 13959 — Addressing the Threat from Securities Investments That Finance 
Communist Chinese Military Companies, 86 Fed. Reg. 4875. 


6! Covered List Public Notice; see 47 CFR § 1.50002. 
62 47 CFR § 1.50002; see Secure Networks Act § 2. 


63 47 CFR § 1.50002. If the Covered List is not updated within one year, PSHSB will issue a public notice 
indicating that no updates were necessary during such period. Id. 


64 47 U.S.C. § 302a. Section 302(b) states that “[n]o person shall manufacture, import, sell, offer for sale, or ship 
devices or home electronic equipment and systems, or use devices, which fail to comply with regulations 
promulgated pursuant to this section.” 


65 47 CFR § 2.901. 
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imported to the United States. The Commission’s part 2 rules not only minimize the potential for 
harmful interference, but also ensure that those devices comply with the rules that address other policy 
objectives — such as human RF exposure limits,°’ hearing aid compatibility with mobile handsets, and 
the Anti-Drug Abuse Act of 1988 (rule section 2.911(d)(2)).” 


24. From the outset, the equipment authorization program codified in part 2 of the 
Commission’s rules has been tied to our efforts to ensure that RF devices imported to or marketed within 
the United States comply with the Commission’s technical requirements. The Commission promulgated 
its marketing rules in 1970 to control the marketing of RF devices having an interference potential.” To 
achieve that control, the Commission required that all such devices could not be imported into the United 
States, or shipped or sold in this country, unless those devices complied with the Commission’s technical 
regulations.’! In addition, if the Commission’s rules imposed a requirement for equipment authorization 
for an RF device, that device could not be imported, shipped, or sold here, unless the required 
authorization had previously been granted by the Commission.” In December 1975, the Commission 
amended its rules with respect to the importation of certain electronic equipment, setting out the 
conditions under which RF devices and subassemblies of RF devices capable of causing harmful 
interference to radio communications may be imported into the United States.” Specifically, the 
Commission adopted a new subpart K to part 2, which stated, in part, regarding RF equipment: “In 
addition to the technical standards, the rules governing the service may require that such equipment 
receive an equipment authorization from the Commission as a prerequisite for marketing and importing 
this equipment into the U.S.A.” Subpart K has been modified in other proceedings over the past 45 
years, but that sentence remains as a foundation for that subpart.” In 1998, the Commission eliminated 
two of the five categories of equipment authorization and relaxed the authorization procedures for devices 


66 See 47 CFR part 2 Subpart I, §§ 2.801 et seq. (Marketing of Radio Frequency Devices); part 2 Subpart J, §§ 2.901 
et seq. (Equipment Authorization Procedures); part 2 Subpart K, §§ 2.1201 et seq. (Importation of Devices Capable 
of Causing Harmful Interference). The Office of Engineering and Technology (OET) administers day-to-day 
operation of the equipment authorization program. See 47 CFR § 0.241(b). OET’s Laboratory Division maintains a 
webpage devoted to the equipment authorization program. See the FCC’s, Equipment Authorization Approval 
Guide, https://www.fcc.gov/engineering-technology/laboratory-division/general/equipment-authorization. 


67 See 47 CFR §§ 2.1091, 2.1093. 
68 See 47 CFR § 20.19. 


69 See 47 CFR § 2.911(d)(2); see also Amendment of Part 1 of the Commission's Rules to Implement Section 5301 of 
the Anti-Drug Abuse Act of 1988, Gen. Docket No. 90-312, Report and Order, 6 FCC Red 7551 (1991) (ADAA 
Report and Order). The ADAA required any entity receiving a “federal benefit” to certify compliance with ADAA 
requirements. In its decision implementing the ADAA, the Commission applied the definition of "license" found in 
the Administrative Procedure Act (APA) to determine the scope of the term "license" as used in section 5301 of the 
ADAA, and thus to define the scope of federal benefits. The APA defines “license” as including “the whole or part 
of an agency permit, certificate, approval, registration, charter, membership, statutory exemption or other form of 
permission.” 5 U.S.C. § 551(8). The ADAA Report and Order found that a wide range of Commission-regulated 
entities in various services must certify compliance with ADAA requirements. 


7 See Amendment of Part 2 of the Commission’s Rules to Prescribe Regulations Governing the Sale or Import of 
Shipment for Sale of Devices Which Cause Harmful Interference to Radio Communications, Docket No. 18426, 
Report and Order, 23 FCC 2d 79 (1970). 


71 Id. at 81, para. 6. 


72 Td. at 89, Appendix B at § 2.803. Equipment authorization at that time consisted of three categories: type 
approved, type accepted, and certificated; see 47 CFR § 2.803 (1970). 


73 See Amendment of Part 2 With Respect to Importation of Certain Electronic Equipment, Docket No. 20194, 
Report and Order, 59 F.C.C.2d 1083 (1976). 


74 Id. at 1089, Appendix A at § 2.1201(a). 
15 47 CER § 2.1201(a). 
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that had a good history of compliance, allowing many consumer electronic devices to be authorized using 
self-approval procedures.” Later that year, the Commission approved the use of Telecommunications 
Certification Bodies (TCBs) to issue grants of Certification for certain RF devices in lieu of traditional 
grants being issued by the Commission. The creation of TCBs allowed the Commission to implement 
Mutual Recognition Agreements with the European Union, the Asia-Pacific Economic Cooperation, and 
other foreign trade partners.” In 2014, the Commission updated its RF equipment authorization program 
by delegating the processing of all certification application to TCBs.”8 


25; In recent years, the Commission has taken steps to streamline the equipment 
authorization approval processes. As we recently discussed, the rapid and widespread deployment of RF 
devices has enabled the communications sector to drive innovation, promote economic growth, and 
become integral to nearly all aspects of modern life.” The Commission’s equipment authorization 
program is essential to ensuring that the communications equipment Americans rely on every day, such as 
their cellphones and Wi-Fi devices, comply with the Commission’s technical rules.8° As we further 
noted, the number of devices now being authorized has expanded into the millions, RF equipment supply 
chains have become increasingly global, and manufacturers are under growing pressure to shorten the 
time it takes to bring new products to market.*! 


26. The last significant additions to the equipment authorization regulatory framework were 
adopted in 2017. In the 20/7 Equipment Authorization Order, the Commission modernized certain rules 
to align the equipment authorization processes with the current state of RF device technology and the 
global marketplace by, among other things, codifying contemporary electronic labeling (e-label) 
practices, modifying importation procedures and filing requirements, and changing the rules governing 
how personal devices and those used in trade shows may be brought into the country.*? The 20/7 
Equipment Authorization Order was part of a comprehensive review of the equipment authorization 
procedures that the Commission initiated in 2015.8 


27; The Commission’s current rules provide two different approval procedures for equipment 
authorization — Certification of equipment and Supplier’s Declaration of Conformity (SDoC).* Asa 
general matter, for an RF device to be marketed or operated in the United States, it must have been 


76 See Streamlined Equipment Authorization Process for Radio Frequency Equipment, ET Docket No. 97-94, Report 
and Order, 13 FCC Red 11415 (1998). 


77 See 1998 Biennial Regulatory Review — Amendment of Parts 2, 25 and 68 of the Commission's Rules to Further 
Streamline the Equipment Authorization Process for Radio Frequency Equipment, Modify the Equipment 
Authorization Process for Telephone Terminal Equipment, Implement Mutual Recognition Agreements and Begin 
Implementation of the Global Mobile Personal Communications by Satellite (GMPCS) Arrangements, GEN Docket 
No. 98-68, Report and Order, 13 FCC Red 24687 (1998). 


78 See Amendment of Parts 0, 1, 2, and 15 of the Commission’s Rules Regarding Authorization of Radiofrequency 
Equipment, ET Docket No. 13-44, Report and Order, 29 FCC Red 16335 (2014). 


7 See, e.g., Allowing Earlier Equipment Marketing and Importation Opportunities, ET Docket 20-382, Notice of 
Proposed Rulemaking, 35 FCC Red 14458 (2020). 


80 Jd. at 14458, para. 1. 
81 Jd. at 14459, para. 5. 


82 Amendment of Parts 0, 1, 2, 15 and 18 of the Commission’s Rules regarding Authorization of Radiofrequency 
Equipment, ET Docket No. 15-170, First Report and Order, 32 FCC Red 8746 (2017) (2017 Equipment 
Authorization Order). 


83 See Amendment of Parts 0, 1, 2, 15, and 18 of the Commission’s Rules regarding Authorization of Radiofrequency 
Equipment, ET Docket No. 15-170, Notice of Proposed Rulemaking, 30 FCC Red 7725 (2015) (2015 Equipment 
Authorization Notice). 


84 See, e.g., 2017 Equipment Authorization Order, 30 FCC Red at 14459, para. 6. 
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authorized for use through one of these two processes. We note, however, that some RF equipment has 
been exempted from the need for an equipment authorization.** 


28. Certification of Equipment. In the certification process, which is the required process for 
RF devices with the greatest potential to cause harm to consumers or other radio operations, an equipment 
authorization is issued by an FCC-recognized Telecommunication Certification Body (TCB). 
Certification is required for transmitters** and some unintentional radiators.*? Examples of this equipment 
include wireless provider base stations and most transmitters in the associated services (e.g., Commercial 
Mobile Radio Services), Wi-Fi access points and routers, home cable set-top boxes with Wi-Fi, laptops, 
tablets, intelligent home devices, and most wireless consumer equipment. Through the certification 
process, applicants file applications containing certain specified information required under the 
Commission’s rules for that equipment — including various representations, written and signed 
certifications, and requisite information about the equipment (e.g., technical test data).8* The TCB makes 
a determination as to whether to grant an equipment authorization based on evaluation of the supporting 
documentation and test data submitted to the TCB.*® In this process, the Commission, through its Office 
of Engineering and Technology (OET), has general oversight of the certification application process, and 
OET provides guidance to TCBs through “pre-approval” guidance and its knowledge database system 
(KDB).° Applications that involve certain categories of equipment or types of testing require a TCB to 
obtain “pre-approval guidance” from the Commission before the application may be approved.®! If the 
TCB makes a determination to grant an equipment certification, information about this authorization is 
posted on a Commission-maintained public database.” 


29. The part 2 rules also include various provisions that help ensure the integrity of the 
equipment authorization process. The Commission is authorized to dismiss or deny an application where 
that application in not in accordance with Commission requirements” or the Commission is unable to 
make the finding that grant of the application would serve the public interest.” The rules also provide 
that the TCB or Commission may set aside a grant of certification within 30 days if it is determined that 
such authorization does not comply with necessary requirements.’ The rules also require the TCB to 
perform “post market surveillance” of equipment that has been certified, with guidance from OET, as 
may be appropriate.” Revocation of an existing equipment authorization is also authorized for certain 


85 See, e.g., 47 CER § 15.103. 
86 See, e.g., 47 CFR §§ 15.201, 95.335. 
87 47 CFR § 15.101. 


88 See 47 CFR §§ 2.907 (Certification), 2.911-926 (Applications), 2.960-964 (Telecommunications Certification 
Bodies), 2.103 1-1060 (Certification). 


89 See 47 CFR § 2.907(a). Testing associated with Certification must be performed by an FCC-recognized 
accredited testing laboratory, 47 CFR § 2.948(e). 


” See, e.g., KDB Publication Number: 641163: TCB Program Roles and Responsibilities, 
https://apps.fcc.gov/oetcf/kdb/forms/FTS SearchResultPage.cfm?id=44683 &switch=P. The Knowledge Database 
(KDB) is an OET online database containing policies, procedures, and answers to common equipment authorization 
questions. It is available at www.fcc.gov/labhelp. It also provides a means to submit specific equipment 
authorization questions directly to OET Lab staff. 


91 47 CFR § 2.964. 

92 47 CFR § 2.941. 

93 47 CFR §§ 2.917, 2.919. 

94 47 CFR 8§ 2.915(a), 2.918. 
95 47 CFR § 2.962(f)(6). 

% 47 CFR § 2.962(g). 
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specified reasons (including for false statements and representations in the application and other 
reasons).°7 


30. Supplier’s Declaration of Conformity (SDoC). The Supplier’s Declaration of Conformity 
(SDoC process is available with respect to certain types of RF devices that have less potential to cause 
interference. The SDoC procedure requires the party responsible for compliance (“responsible party”) to 
make the necessary measurements and complete other procedures found acceptable to the Commission to 
ensure that the particular equipment complies with the appropriate technical standards for that device.** 
For example, SDoC is an option’ for certain devices that may be operated under part 15 of the 
Commission’s rules without a license,' specific part 18 consumer industrial, scientific, and medical 
(ISM) equipment,'°! and some transmitters operating in licensed services.! The information provided, at 
the time of marketing or importation, with devices subject to SDoC must include a compliance statement 
that lists a U.S.-based responsible party.'°> The responsible party for equipment subject to the SDoC 
process could include the equipment manufacturer, the assembler (if the equipment is assembled from 
individual component parts and the resulting system is subject to authorization), or the importer (if the 
equipment by itself or the assembled system is subject to authorization).! The SDoC signifies that the 
responsible party has determined that the equipment has been shown to comply with the applicable 
technical standards.'°° Each responsible party is required to retain records demonstrating that the 
equipment complies with the applicable Commission requirements.!°° The Commission can specifically 
request that such information on particular equipment be provided to the Commission.!” 


31. Equipment exempted from an equipment authorization requirement. Section 15.103 of 
our rules exempts certain RF devices from an equipment authorization.'°° This exemption pertains to 
specified digital devices contained in several types of products that generate such low levels of RF 
emission that they have virtually no potential for causing harmful interference to he authorized radio 


°7 47 CFR § 2.939. 


%8 See 47 CFR §§ 2.906 (“Supplier’s Declaration of Conformity”); 2.909 (“Responsible Parties”); 2.938 (“Retention 
of records”); 2.945 (“Submission of equipment for testing and equipment records”); 2.1071-1077 (“Supplier’s 
Declaration of Conformity”). 


°° If desired, the responsible party for a device may choose to file an application for certification in lieu of 
completing the SDoC process. See 47 CFR § 2.906(c). 


100 47 CFR § 15.101. 
101 47 CFR § 18.203. 


102 Including, for example, certain broadcast and fixed microwave service transmitters, 47 CFR §§ 73.1660 and 
101.139, respectively. 


103 47 CFR § 2.1077. 

104 47 CFR § 2.909(b)(1)-(2). 
105 47 CFR § 2.1072(a). 

106 47 CFR § 2.938. 


107 47 CFR §§ 2.906(a), 2.945(b)(1) (Commission may request that the responsible party or any other party 
marketing the equipment submit a sample), 2.945(c) (upon request by the Commission, each responsible party shall 
submit copies of records required under the Commission’s rules, including -- the original design drawings and 
specification; procedures for inspection and testing; test results; actual date of testing; name of the test lab, company, 
or individual performing the testing; description of the equipment; and/or the “compliance information” required 
under the rules). See 47 CFR § 2.1077 (Compliance information). 


108 47 CFR § 15.103. 
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services. Exempt devices include unintentional radiators,!'° such as those that are used exclusively in 
the following — transportation vehicles, including motor vehicles and aircraft; as an electronic control or 
power system utilized by a public utility or in an industrial plant; as industrial, commercial, or medical 
test equipment; and in an appliance. It also excludes devices that are used for specialized medical use, 
have a very low power consumption (i.e., not exceeding 6 nW), are used in joystick or similar controllers, 
or are devices that operate on low frequencies (i.e., below 1.705 MHz) and which do not operate from the 
AC power lines or contain provisions for operation while connected to the AC power lines.!!! 
Additionally, most satellite transmitters'!? and most amateur radio equipment!" do not require an 
equipment authorization and certain specified equipment regulated under other rule parts also does not 
require equipment authorization. 


32. Existing part 2 rules and “covered” equipment on the Covered List. At this time, the 
Commission’s current equipment authorization rules do not include specific provisions addressing the 
“covered” equipment on the Covered List. 


C. Certifications in Commission Competitive Bidding and Prospective Safeguards in 
the Public Interest 


33. The Commission uses competitive bidding to determine which among multiple applicants 
with mutually exclusive applications for a license may file a full application for the license.!'4 This 
process furthers multiple public interest objectives, including the development and rapid deployment of 
new technologies, products, and services without delays and the efficient and intensive use of the 
electromagnetic spectrum. !!5 


34. Congress gave the Commission the authority to require such information and assurances 
from applicants to participate in competitive bidding as is necessary to demonstrate that their application 
is acceptable.!!® Pursuant to this authority, the Commission has required each applicant to participate in 
competitive bidding to make various certifications.''’ The substance of these required certifications cover 
a range of public interest concerns related to the conduct of competitive bidding and the national security 
interest in precluding some parties from becoming licensed through competitive bidding.'!* Parties 
unable to make the required certifications have their applications to participate dismissed. !!° 


10 Revision of Part 15 of the Rules Regarding the Operation of Radio Frequency Devices without an Individual 
License, GN Docket No. 87-389, Notice of Proposed Rulemaking, 2 FCC Red 6135, 6140, para. 39 (1987). 


110 An unintentional radiator is a device that intentionally generates radio frequency energy for use within the device, 
or that sends radio frequency signals by conduction to associated equipment via connecting wiring, but which is not 
intended to emit RF energy by radiation or induction. See 47 CFR § 15.3(z). 


11 Jd, 


112 Satellite communications are regulated under part 25 of the Commission’s rules. Subpart B of that part specifies 
general rules and subpart D specifies technical standards for satellite transmitters, but equipment authorization is not 
specified, except for portable earth-station transceivers. See 47 CFR § 25.129. 


113 The Amateur radio service is regulated under part 97 of the Commission’s rules. Subpart D of that part specifies 
technical standards for equipment, but only external RF power amplifiers are subject to equipment authorization; see 
47 CFR § 97.315. 


114 See 47 U.S.C. § 309q)(1). 

115 See 47 U.S.C. § 309()(3)(A), (D). 
116 See 47 U.S.C. § 309G)(5). 

117 47 CFR § 1.2105(a)(2)(iv)-(xiii). 


118 See 47 CFR § 1.2105(a)(2)(ix) (regarding joint bidding arrangements) and (xiii) (regarding bars against 
participation in certain auctions based on national security). 


119 47 CFR § 1.2105(b)(1). 
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II. DISCUSSION 


35. In this Notice of Proposed Rulemaking and Notice of Inquiry we examine our rules 
relating to equipment authorization and participation in Commission auctions to help advance the 
Commission’s goal of protecting national security and public safety. This proceeding builds on other 
actions the Commission recently has taken to protect and secure our nation’s communications systems. 


36. As described above, in other proceedings over the last three years, the Commission has 
taken several actions to prevent use of equipment and services that pose an unacceptable risk to our 
nation’s communications networks.!™® In June 2020, The Public Safety and Homeland Security Bureau 
designated Huawei and ZTE as national security threats to the integrity of communications networks, 
prohibiting the use of Universal Service Fund support to purchase, obtain, maintain, improve, modify, or 
otherwise support any equipment or services produced or provided by Huawei and ZTE.!#! Most 
recently, the Public Safety and Homeland Security Bureau (PSHSB), as required by the December 2020 
Supply Chain Second Report and Order,'? published the Covered List, which identifies “covered” 
equipment and services that pose an unacceptable risk to national security or to the security and safety of 
U.S. persons.'? PSHSB will continue to update that list as appropriate. Although the Commission, 
through PSHSB, publishes and updates the Covered List, the equipment and services included on the list 
are identified by specific external sources enumerated in the Secure Networks Act.!*4 


37. This Covered List identifies communications equipment and services that pose an 
unacceptable risk to the national security of the United States or the security and safety of United States 
persons. The Commission is required to include communications equipment and services on the list 
based exclusively on determinations made by Congress and by other U.S. government agencies.!”° 
Currently, the list includes equipment and services produced or provided by five entities: 


e “Telecommunications equipment produced or provided by” Huawei Technologies Company 
or ZTE Corporation, or their respective subsidiaries and affiliates, “including 
telecommunications or video surveillance services produced or provided by such [entities] or 
using such equipment;” and 


e “Video surveillance and telecommunications equipment produced or provided by” Hytera 
Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua 
Technology Company, or their respective subsidiaries and affiliates, “to the extent it is used 
for the purpose of public safety, security of government facilities, physical security 
surveillance of critical infrastructure, and other national security purposes, including 
telecommunications or video surveillance services produced or provided by such [entities] or 
using such equipment.” !?6 


120 See Section II.A, above (discussion of recent Commission proceedings and actions). 


121 See Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs 
— Huawei Designation, PS Docket No. 19-351, Order, 35 FCC Red 6604 (PSHSB 2020) (Huawei Designation 
Order); See Protecting Against National Security Threats to the Communications Supply Chain Through FCC 
Programs — ZTE Designation, PS Docket No. 19-352, Order, 35 FCC Red 6633 (PSHSB 2020) (ZTE Designation 
Order). 


122 Supply Chain Second Report and Order, 35 FCC Red 14284. 
1233 Covered List Public Notice; see 47 CFR § 1.50002. 

124 47 CER § 1.50002(b)(1)(i)-(iv). 

125 Secure Networks Act, § 2(c) (47 U.S.C. § 1601(c)). 


126 Covered List Public Notice at 3. As noted in this Public Notice, where equipment or services on the list are 
identified by category, such category should be construed to include only equipment or services capable of the 
functions outlined in sections 2(b)(2)(A), (B), or (C) of the Secure Networks Act. 47 U.S.C. § 1601(b)(2)(A)-(C). 
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Under the Secure Networks Act and the Commission’s new rule, part 1, subpart DD, inclusion of 
equipment and services on the Covered List precludes the use of federal subsidy funds — e.g., funds from 
the Commission’s Universal Service Programs — to obtain or maintain such equipment or services. !77 


38. The Notice of Proposed Rulemaking seeks comment on various steps that the 
Commission could take in its equipment authorization program, as well as its competitive bidding 
program, to reduce threats posed to our nation’s communications system. In the Notice concerning our 
equipment authorization rules and processes, we propose revisions to the Commission’s equipment 
authorization rules and procedures under part 2 to prohibit authorization of any “covered” equipment on 
the Covered List. We also seek comment on whether to revise the rules on equipment currently exempted 
from the equipment authorization requirements to no longer permit this exemption for such “covered” 
equipment. In addition, we seek comment on whether the Commission should revoke equipment 
authorizations of “covered” equipment, and if so under what conditions and procedures. Finally, we 
include in the Notice questions concerning possible revisions to the Commission’s competitive bidding 
procedures that could address certain concerns related to “covered” equipment and services. Notably, the 
Commission must “periodically update the list . . . to address changes in [external] determinations .. . 
[and] shall monitor the making and reversing of determinations . .. in order to place additional 
communications equipment or services on the list . . . or to remove communications equipment and 
services from such list.”!?8 If one of the enumerated sources named in the Secure Networks Act modifies 
or deletes a determination, PSHSB will do the same and modify the Covered List accordingly." We 
seek comment on how future updates to the Covered List should affect our proposals in this Notice. 


39. We also adopt a Notice of Inquiry seeking comment on other actions that the 
Commission should consider taking within the context of equipment authorizations that would serve to 
protect our nation’s communications networks and incentivize manufacturers to develop and produce 
equipment that is more resilient and secure. 


A. Notice of Proposed Rulemaking 
1. Equipment Authorization Rules and Procedures 


40. In this Notice, we propose revisions to the Commission’s equipment authorization rules 
and processes to prohibit authorization of any “covered” equipment on the Covered List. This prohibition 
would apply to “covered” equipment on the Covered List maintained and updated by PSHSB. We also 
seek comment on whether our rules concerning equipment currently exempted from the equipment 
authorization requirement should be revised to ensure that any “covered” equipment cannot qualify for 
such exemption. In addition, we seek comment on whether we should revoke any of the authorizations 
that have been previously granted for “covered” equipment on the Covered List, and if so, which ones and 
through what procedures. Finally, we seek comment on new certifications for applicants that wish to 
participate in Commission auctions that would further address the risks posed by companies that the 
Commission has designated as posing a national security threat to the integrity of communications 
networks and the communications supply chain. 


127 47 U.S.C. § 1602; 47 CFR § 1.50000 et seq.; see Protecting Against National Security Threats to the 
Communications Supply Chain Through FCC Programs, WC Docket No. 18-89, Declaratory Ruling and Second 
Further Notice of Proposed Rulemaking, 35 FCC Red 7821, 7825-28, paras. 16-22 (2020). 


128 Secure Networks Act § 2(d)(1)-(2); see also 47 CFR § 1.50003. 


129 See 47 CFR § 1.50003(b) (if a determination regarding covered communications equipment or service on the 
Covered List is reversed or modified, directing PSHSB to remove from or modify the entry of such equipment or 
service on the Covered List, except if any of the sources identified in 47 CFR § 1.50002(b)(1)(i)-(iv) maintains a 
determination supporting inclusion of such equipment or service on the Covered List). 
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a. Equipment Authorization Rules Under Part 2 
(i) General Provisions of Subpart J 
41. The Commission’s rules and procedures set forth in part 2 of the Commission’s rules 


include requirements and processes for equipment marketing,!*° authorization,'*! and importation. !? We 
propose to adopt the following new provision, section 2.903, as part of the “General Provisions” of 
subpart J, to provide general guidance regarding the prohibition on equipment authorizations with respect 
to communications equipment on the Covered List: 


§ 2.903 Prohibition on equipment authorization of equipment on the Covered List. 


Any equipment on the Covered List, as defined in § 1.50002 of this chapter, is prohibited from 
obtaining an equipment authorization under this subpart. This includes: 


(a) Equipment subject to certification procedures: Telecommunication Certification Bodies and 
the Federal Communications Commission are prohibited from issuing a certification under 
this subpart for any equipment on the Covered List; and 


(b) Equipment subject to Supplier’s Declaration of Conformity procedures. 


In proposing this new rule section, we seek to establish a clear prohibition on authorization of any 
“covered” equipment in our equipment authorization processes regardless of the process to which that 
equipment is subject. We seek comment on this proposed rule. Is this rule sufficient to prohibit any such 
equipment on the Covered List from being authorized for use in the United States? What modifications 
or clarifications are needed to this proposed language to ensure that the rule is clear as to its scope and 
effect and attains results commensurate with its purpose to protect national security? Are there additional 
provisions that should be included here to more fully capture the scope of our proposed prohibition?!33 


42. We note that, if the Commission were to adopt this proposal to revise the Commission’ s 
subpart J equipment authorization rules to prohibit any further authorization of “covered” equipment 
through the certification or SDoC processes, this decision would also serve to prohibit the marketing of 
such equipment that would now be prohibited from authorization under subpart I of the Commission’s 
part 2 rules (Marketing of Radio-Frequency Devices)'*4 and importation of equipment under subpart K 
(Importation of Devices Capable of Causing Harmful Interference) of the Commission’s part 2 rules. 
Section 2.803(b) of subpart I only permits persons to import or market RF devices that are subject to 
authorization under either the certification or SDoC process, as set forth in the Commission’s subpart J 
rules, once those devices have been authorized,'*5 unless an exception applies.'3° Similarly, our proposed 


130 47 CFR §§ 2.801 et seq. 
131 47 CFR §§ 2.901 et seq. 
132 47 CFR §§ 2.1201 et seq. 


133 We note that provisions in various rule parts exempt certain types or classes of equipment from certification or 
other approval requirements and seek comment on whether that equipment need also be included here or whether 
specific provisions need to be placed in those rule parts to ensure that covered equipment cannot be used. For 
example, devices described in section 15.103 are not subject to any equipment authorization procedures. Similarly, 
section 90.203 generally requires all devices that operate under that part to be certified but contains provisions that 
exempts certain devices from that requirement. Under part 25, only portable earth station transceivers are subject to 
equipment certification procedures; all other Part 25 equipment is exempt for equipment authorization procedures. 
See 47 CFR § 25.129. Also, under Part 97 only external power amplifiers used in the Amateur Radio Service are 
required to obtain equipment certification; all other equipment is exempt from equipment authorization procedures. 
See 47 CFR § 97.315. 


134 47 CFR §§ 2.801 et seq. 
135 47 CFR § 2.803(b) (concerning Part 2 Subpart I rules, “Marketing of Radio-Frequency Devices”). 
136 47 CFR § 2.803(c) (listing the exceptions to the general rule of section 2.803(b)). 
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revisions in subpart J, above, also would serve to prohibit importing or marketing of “covered” equipment 
if it is subject to authorization through either the certification or SDoC process in subpart J and has not 
been authorized, per sections 2.1201(a) and 2.1204(a).'57 We seek comment on whether we need to revise 
or provide clarification with regard to how our proposed prohibition of authorization of “covered” 
equipment affects the implementation of the Commission’s rules in either subpart I or subpart K. Would 
the general prohibition we propose for equipment subject to certification and SDoC make any changes to 
subparts I or K unnecessary? If not, what changes are needed to our rules in those subparts? 


43. Below, we seek comment on other revisions that the Commission should make regarding 
equipment authorization either through the certification or SDoC rules and procedures. We discuss and 
seek comment on how our proposed rule should be implemented with respect to each of these processes, 
and whether other rule revisions or clarifications are appropriate. While the vast majority of RF devices 
are subject to either certification or an SDoC under the rules in subpart J, there is a limited category of 
devices that are exempt from these authorization processes. We also seek comment on how best to 
address this equipment. 


(ii) Certification Rules 


44. Background. As described in brief above, under the Commission’s equipment 
authorization rules, certain radiofrequency devices that have the greatest potential to cause harmful 
interference to radio services, must be processed through the equipment certification procedures. 
Certification generally is required for equipment that consists of radio transmitters!3* as well as some 
unintentional radiators.!3? Examples of equipment that requires certification include mobile phones, 
wireless provider base stations, point-to-point and point-to-multipoint microwave stations, land mobile, 
maritime and aviation radios, remote control transmitters, wireless medical telemetry transmitters, Wi-Fi 
access points and routers, home cable set-top boxes with Wi-Fi, and most wireless consumer equipment 
(e.g., tablets, smartwatches and smart home automation devices). Applicants are required to file with an 
FCC-recognized Telecommunication Certification Body (TCB) applications containing specified 
information.'4° Each applicant is required to provide the TCB with all pertinent information as required 
by the Commission’s rules.'4! These requirements generally specify the information necessary to 
document compliance with the testing requirements that broadly apply to RF devices used under authority 
of the Commission, including devices used under licensed radio services and devices used on an 
unlicensed basis.'*? Additional application information is required to demonstrate compliance with 
specific technical requirements in particular service rules (e.g., that antennas on certain unlicensed part 15 
devices are not detachable! or that certain part 90 private land mobile transmitters meet required 
efficiency standards!) or other broadly applicable policy-related Commission requirements (e.g., 
compliance with the Anti-Drug Abuse Act!45). By signing the application for equipment authorization 
(FCC Form 731), each applicant attests that the information provided in all statements and exhibits 


137 47 CFR §§ 2.1201(a), 2.1204(a) (concerning part 2, subpart K rules, “Importation of Devices Capable of Causing 
Harmful Interference”). 


138 See e.g., 47 CFR §§ 25.129, 27.51, 95.361. 
139 47 CFR § 15.101. 


140 See 47 CFR §§ 2.907 (Certification), 2.911-926 (Applications), 2.960-964 (Telecommunication Certification 
Bodies), 2.103 1-1060 (Certification). 


141 See, e.g., 47 CFR §§ 2.911(d), 2.1033(a). 

142 See, e.g., 47 CFR §§ 2.1033(b), 2.1033(c)(1)-(14). 
143 47 CFR § 15.203. 

144 47 CFR § 90.203(j). 

145 47 CFR §§ 1.2002; 2.911(d)(2). 
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pertaining to that particular equipment are true and correct.!4* The TCB then makes a determination as to 
whether to grant an equipment certification based on evaluation of the submitted documentation and test 
data.'47 The Commission, through OET, oversees the certification application process, and provides 
guidance to applicants, TCBs, and test labs through its pre-approval guidance (including its knowledge 
database system (KDB)) with regard to required testing and other information associated with 
certification approval procedures and processes.'*8 Applications that involve new technology or for which 
there are no FCC-recognized test procedures require a TCB to obtain pre-approval guidance from the 
Commission before the application may be approved.'*? Once a TCB makes a determination, either on its 
own or after consultation with the Commission, to grant an equipment certification, information about 
that authorization is publicly announced “in a timely manner” through posting on the Commission- 
maintained Equipment Authorization System (EAS) database,!*° and referenced via unique FCC identifier 
(FCC ID).'5! Once this original certification is granted, the device is subject to rules that specify 
requirements: for modifying equipment,!*? marketing under or changing FCC ID,!* and transferring 
ownership of an FCC ID.!*4 


45. The Commission’s part 2 rules also include various provisions that help ensure that 
equipment certifications comply with Commission requirements. The Commission is authorized to 
dismiss or deny an application where that application is not in accordance with Commission 
requirements!55 or the Commission is unable to make a finding that grant of the application would serve 
the public interest.'°° The rules also provide that the TCB or Commission may set aside a certification 
within 30 days of grant if it determines that the equipment does not comply with necessary 


146 See FCC Form 731, “Applicant/Agent Certification” section which states, “I certify that I am authorized to sign 
this application. All of the statements herein and the exhibits attached hereto, are true and correct to the best of my 
knowledge and belief. IN accepting a Grant of Equipment Authorization issued by the FCC as a result of the 
representations made in this application, the applicant is responsible for (1) labeling the equipment with the exact 
FCC ID specified in this application, (2) compliance statement labeling pursuant to the applicable rules, and (3) 
compliance of the equipment with the applicable technical rules. If the applicant is not the actual manufacturer of the 
equipment, appropriate arrangements have been made with the manufacturer to ensure that production units of this 
equipment will continue to comply with the FCC's technical requirements. 


Authorizing an agent to sign this application, is done solely at the applicant's discretion; however, the applicant 
remains responsible for all statements in this application. 


If an agent has signed this application on behalf of the applicant, a written letter of authorization which includes 
information to enable the agent to respond to the above section 5301 (Anti-Drug Abuse) Certification statement has 
been provided by the applicant. It is understood that the letter of authorization must be submitted to the FCC upon 
request, and that the FCC reserves the right to contact the applicant directly at any time.” 


147 See 47 CFR § 2.907(a). Testing associated with Certification must be performed by an FCC-recognized 
accredited testing laboratory, 47 CFR § 2.948(e). 


148 See, e.g., §§ 2.947(a)(3) and 2.1093(d)(2) which state that advisory information regarding measurement 
procedures can be found in the KDB. 


14 47 CFR § 2.964. 

150 47 CFR § 2.941. Certified devices are associated with a unique FCC Identification Number. 
151 47 CFR §§ 2.925, 2.926. 

152 47 CFR §§ 2,962, 2.1043. 

153 47 CFR §§ 2.924, 2.933 

154 47 CFR § 2.929. 

155 47 CFR § 2.917. 

156 47 CFR §§ 2.915(a), 2.918. 
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requirements.!5 The rules also require the TCB to perform “post market surveillance” of equipment that 
has been certified, with guidance from OET, as may be appropriate.!** Revocation of an existing 
equipment authorization is also authorized for various reasons, including for false statements and 
representations in the application. And an authorization may be withdrawn if the Commission changes its 
technical standards.!*° 


46. Discussion. We propose certain additional revisions to the Commission’s rules and 
processes regarding equipment certification. In proposing to revise our equipment certification rules, our 
goal is to design a process that efficiently and effectively prohibits authorization of “covered” equipment 
without delaying the authorization of innovative new equipment that benefits our lives. 


47. We propose revising the equipment certification application procedures to include a new 
provision in section 2.911 that would require applicants to provide a written and signed attestation that, as 
of the date of the filing of the application, the equipment for which the applicant seeks certification is not 
“covered” equipment on the Covered List. Specifically, any applicant for certification would attest that 
no equipment (including component part) is comprised of any “covered” equipment, as identified on the 
current published list of “covered” equipment. This new provision also would cross-reference section 
1.50002 of the Commission’s rules that pertain to the Covered List.!©° We seek comment on this 
proposal. We also invite comment on particular language that should be included in this attestation. For 
instance, to what extent should we consider basing this attestation language on the certifications that 
providers of advanced communications services must complete to receive a Federal subsidy made 
available through a program administered by the Commission that provides funds to be used for the 
capital expenditures necessary for the provision of advanced communications services? Are there 
additional compliance measures beyond the attestation that we should consider? Should the applicant 
have an ongoing duty during the pendency of the application to monitor the list of covered equipment and 
provide notice to the TCB or the Commission if, subsequent to the initial filing of the application or at the 
time a grant of certification, the equipment or a component part had become newly listed as “covered” 
equipment in an updated Covered List? 


48. Section 2.1033 discusses information that must be included in the application. We seek 
comment on whether there are revisions that the Commission should adopt in this rule provision that 
would further clarify our proposals regarding prohibition of the certification of any “covered” equipment. 
What information may be pertinent to assist the TCBs and the Commission in ensuring that applications 
do not seek certification of “covered” equipment? Should the Commission require that the applicant 
provide certain information that would help establish that the equipment is not “covered” equipment to 
assist TCBs and the Commission in making determinations about whether to grant the application? For 
example, the Commission currently requires applicants to file block diagrams or schematic diagrams of 
their devices.'°! Should we also require a parts list noting the manufacturer of each part? If we were to 
adopt such a requirement, should it apply to all or only certain components? Which ones? How much 
additional burden, if any, would this place on applicants as compared to the current level of effort needed 
to prepare an equipment certification application? 


49. We propose to direct OET to develop guidance for use by interested parties, including 
applicants and TCBs, regarding the Commission’s proposed prohibition on certification of “covered” 
equipment. In particular, we propose to direct PSHSB, the Wireline Competition Bureau (WCB), the 
Wireless Telecommunications Bureau, the International Bureau, and the Enforcement Bureau to assist 


157 47 CFR § 2.962(f)(6). 

158 47 CFR § 2.962(g). 

159 47 CFR § 2.939. 

160 47 CFR § 1.50002 (Covered List). 
161 47 CFR § 2.1033(b)(5). 
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OET in developing pre-approval guidance!® that provides the necessary guidance that TCBs can use and 
should follow in implementing the proposed prohibition. PSHSB, which is tasked with publication of the 
Covered List, and has significant responsibilities and expertise regarding ensuring that our nation’s public 
safety communications networks are secure, can lend important assistance by collaborating with OET to 
provide such guidance.! We seek comment on this proposal. We also seek comment on whether the 
current pre-approval guidance rule (or the use of KDBs) should be revised or clarified consistent with our 
goals in this proceeding. 


50. As we have noted, following a TCB’s grant of certification the Commission will post 
information on that grant “in a timely manner” on the Commission-maintained public EAS database.'™ 
As we have also noted, the TCB or Commission may set aside a grant of certification within 30 days of 
the grant date if it is determined that such authorization does not comply with applicable requirements or 
is not in the public interest.'! To what extent should interested parties, whether the public or government 
entities (e.g., other expert agencies) be invited to help inform the Commission as to whether particular 
equipment inadvertently received a grant by the TCB and is in fact (or might be) “covered” equipment 
such that the grant should be set aside? Should the Commission consider adopting any new procedures 
for gathering and considering information on potentially relevant concerns that the initial grant is not in 
the public interest and should be set aside? Should such procedures be limited to certain parties (e.g., 
expert agencies), or certain minimal showings required by those that seek to raise questions about the 
grant?!6 


51. Section 2.962(g) of our current rules expressly provides for “post-market surveillance” 
activities with respect to products that have been certified.'* We propose to direct OET, in exercising its 
delegated authority, to provide TCBs with guidance on the kinds of post-market surveillance that should 
be conducted to help ensure that no equipment that subsequently has been authorized includes “covered” 
equipment that has not been authorized. Here, we seek comment on whether revisions or clarifications to 
the post-market surveillance requirements should be adopted. Under existing rules, each TCB is required 
to conduct type testing of samples of product types that it has certified. OET has delegated authority to 
develop procedures that TCBs will use for performing such post-market surveillance, including the 
responsibility for publishing a document on the post-market surveillance requirements that will provide 
specific information such as the numbers and types of samples the TCBs must test. OET may also 
request that a grantee of equipment certification submit a sample directly to the TCB that performed the 
original certification for its evaluation. TCBs also may request samples directly from the grantee. If in 
this post-market surveillance the TCB determines that the product fails to comply with the technical 
regulation for that product, the TCB then notifies the grantee and the grantee must then describe actions 


162 47 CFR § 2.964 (Pre-approval guidance procedure for Telecommunications Certification Bodies). 


16 We note that with regard to the existing list of “covered” equipment is equipment produced or provided by 
Hytera Technologies Company, Hangzhou Hikvision Digital Technology, and Dahua Technology (and the 
subsidiaries and affiliates of these entities) to the extent that the equipment concerns video surveillance and 
telecommunications equipment associated with public safety, security of government facilities, physical security 
surveillance infrastructure, other national security purposes. Covered List Public Notice at 3. PSHSB has important 
regulatory responsibilities and subject matter expertise on this type of equipment. 


164 47 CFR § 2.941. 
165 47 CFR § 2.962(f)(6). 


166 As discussed below with regard to revocation of equipment authorizations, we propose that if the Commission 
were to determine, after this 30-day period, that an applicant made false statements in its application regarding 
“covered equipment,” that authorization can be revoked. See discussion below, paragraph [82]. 


167 47 CER § 2.962(g). 
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taken to the correct the situation. The TCB provides a report of these actions to the Commission within 
30 days.!% 


52. We also seek comment on how our rules should be implemented, or revised or clarified, 
to ensure that equipment users will not make modifications to existing equipment that would involve 
replacing equipment (in whole or part) with “covered” equipment. Should, for instance, the Commission 
revise or clarify its section 2.932 rules regarding modifications or the section 2.1043 provisions 
concerning “permissive changes,” to promote our goals in this proceeding? We also note that section 
2.929 of our equipment authorization rules includes provisions regarding changes in the name, address, 
ownership, or control of the grantee of an equipment authorization.’ An equipment authorization may 
not be assigned, exchanged, or in any other way transferred to a second party, except as provided in this 
section.'!” Should we consider any revisions or clarifications about how these provisions apply in light of 
our proposals regarding prohibition on authorization of “covered” equipment? For example, should we 
prohibit the ownership or control of the certification for any equipment on the Covered List from being 
assigned, exchanged or transferred to another party? 


53. Under our part 2 rules concerning equipment authorization, various provisions are 
included that help ensure that applicants and TCBs comply with their responsibilities related to the 
Commission’s equipment authorization procedures set forth in part 2 Subpart J. We note, for instance, 
that pursuant to section 2.911(d)(1), applicants must provide a written and signed certification to the TCB 
that all statements in its request for equipment authorization are true and correct to the best of its 
knowledge and belief.!”! TCBs, which are subject to the accreditation process, must comply with all 
applicable responsibilities set forth in our part 2 rules for TCBs,!” and if we were we to adopt our 
proposal would be obligated to prohibit the certification of any “covered” equipment. In reviewing the 
applications, TCBs would be required to dismiss any application should they become aware that an 
applicant has falsely asserted that its equipment (or components of the equipment) is not “covered” 
equipment. We seek comment on our implementation of these rules in the context of prohibiting 
certification of “covered” equipment, and any revisions or clarifications that may be appropriate to ensure 
that from this point forward applicants and TCBs comply with our proposed prohibition on authorization 
of “covered” equipment. Should our existing rules or procedures concerning ensuring compliance be 
enhanced with respect to applicants that intentionally attempt to circumvent our rules or TCBs that 
repeatedly fail to meet their responsibilities to comply with our proposed prohibition? 


54. We seek comment on revisions that could better ensure that applicants comply with our 
proposed requirements. Under our current equipment certification rules, the grantee of the certification is 
responsible for compliance of the equipment with the applicable requirements as the “responsible party,” 
as set forth in section 2.909(a).!% In 2017, the Commission revised the rules applicable to equipment 
authorized through the SDoC process (discussed below) to require that the parties responsible under the 
SDoC rules for compliance of equipment authorized under those provisions must be located within the 
United States.'* Many certified devices are also manufactured outside of the United States, and there 
may be no party within the country other than the importer that the Commission could readily contact if 
the equipment is not compliant with the Commission’s requirements. Accordingly, we propose adopting 
the same requirement previously adopted with regard to responsible parties in the SDoC process with 


168 Td. at 2. 
169 47 CFR § 2.929. 
170 Td. 


171 47 CFR § 2.911(d)(1). As we discuss below, false statements or representations are grounds for revocation of the 
equipment authorization. 47 CFR § 2.939(a)(1). 


12 47 CER § 2.962. 
13 47 CER § 2.909%(a). 
174 47 CER §§ 2.909(b); 2.1077(a)(3). 
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regard to responsible parties associated with equipment authorized through the equipment certification 
process.'7> We seek comment. Relatedly, the Commission has encountered difficulties in achieving 
service of process for enforcement matters involving foreign-based equipment manufacturers. Should we 
also require that the applicant for certification of equipment include a party and/or an agent for service of 
process that must be located in the United States? How much additional burden, if any, would these 
requirements place on applicants as compared to the current level of effort needed to prepare an 
equipment certification application? Should we impose a similar requirement on existing equipment 
certification grantees? If so, how would we do so? If not, how should we address the difficulty in 
obtaining service of process on certain foreign-based equipment manufacturers? 


55. As discussed above, PSHSB will periodically publish updates to identify the “covered” 
equipment and services that are on the Covered List." Under our proposals, we accordingly direct that 
OET expeditiously take all the appropriate steps (e.g., updating as necessary the precise certification that 
applicants must make that no newly identified “covered” equipment is associated with the application, as 
well as updating any pre-approval guidance, KDB, or other guidance) to reflect those updates, consistent 
with the rules and procedures that the Commission ultimately adopts regarding the certification rules in 
this proceeding. We invite comment on appropriate means for OET to include updates of the “covered” 
equipment in an expeditious fashion in ways that best ensure that applicants, TCBs, and other interested 
parties will comply with the prohibitions concerning this updated identification of “covered” equipment. 


56. Finally, we seek comment on whether there are other rule revisions or clarifications to the 
equipment certification rules and processes that the Commission should make consistent with our goals to 
prohibit authorization of “covered” equipment. Commenters should explain their suggestions in 
sufficient detail, including the reasoning behind the suggestions and associated issues (e.g., 
implementation). While our proposed prohibition would be reflected in the Commission’s rules and our 
engagement with TCBs in ensuring compliance, we also seek comment any other types of action or 
activity (e.g., outreach and education) that would be helpful to ensure that all parties potentially affected 
by these changes understand the changes and will comply the prohibition associated with “covered” 
equipment. 


(iii) Supplier’s Declaration of Conformity (SDoC) rules 


57. Background. The Supplier’s Declaration of Conformity (SDoC) process is available for 
many types of equipment that have less potential to cause RF interference. Under our rules, the types of 
equipment that may be processed pursuant to the SDoC procedures include fixed microwave transmitters 
(e.g., point-to-point or multipoint transmitter links as well as some links used by carriers and cable 
operators) authorized under part 101, broadcast TV transmitters authorized under Parts 73 and 74, certain 
ship earth station transmitters authorized under Part 80 (Maritime), some emergency locator transmitters 
authorized under part 87 (Aviation), and private land mobile radio services equipment and equipment 
associated with special services such as global maritime distress and safety system, aircraft locating 
beacons, ocean buoys), certain unlicensed equipment (e.g., business routers, firewalls, internet routers, 
internet appliances, wired surveillance cameras, business servers, workstations, laptops, almost all 
enterprise network equipment, computers, alarm clocks) that includes digital circuitry (but no radio 
transmitters) authorized under part 15, certain ISM equipment (e.g., those that use RF energy for heating 
or producing work) authorized under part 18. The SDoC process differs significantly from the 
certification process for equipment authorizations, and relies on determinations about the equipment made 
by the party responsible for compliance (“responsible party” as defined in the rules) as to whether the 
equipment “conforms” with the Commission’s requirements. Using the more streamlined SDoC process 
for the equipment authorization is “optional” insofar as the responsible party may choose to apply for 


175 We note that the Commission has proposed this action in a 2015 Notice of Proposed Rulemaking. 20/5 
Equipment Authorization Notice, 30 FCC Red at 7522, para.75. 


176 Covered List Public Notice at 2. 
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equipment certification through the equipment certification process even if SDoC is acceptable under our 
tules.!77 


58. In the SDoC process, the responsible party makes the necessary measurements and 
completes other procedures found acceptable to the Commission to ensure that the particular equipment 
complies with the appropriate technical standards for that device.!”8 The information provided with 
devices subject to SDoC must include a compliance statement that lists a U.S.-based responsible party. 
As set forth in the rules, the responsible party for equipment subject to the SDoC process could include 
the equipment manufacturer, the assembler (if the equipment is assembled from individual component 
parts and the resulting system is subject to authorization), or the importer (if the equipment by itself or the 
assembled system is subject to authorization),!” and could also include retailers and parties performing 
modification under certain circumstances.'®° The SDoC signifies that the responsible party has 
determined that the equipment has been shown to comply with the applicable technical standards. '*! 
Given the streamlined nature of this particular process, responsible parties are not typically required to 
submit to the Commission an equipment sample or representative data demonstrating compliance. !8? 
Also, while our rules require that the equipment authorized under the SDoC procedure must include a 
unique identifier, the equipment is not listed in a Commission equipment authorization database,'* they 
are required to retain records on the equipment that demonstrate the equipment’s compliance with the 
Commission’s applicable requirements for that equipment.'** The Commission can specifically request 
that the responsible parties provide such information on particular equipment to the Commission.!* 


59. Discussion. We propose that any equipment produced or provided by any of the entities 
(or their respective subsidiaries or affiliates) that produce or provide “covered” equipment, as specified on 
the Covered List, can no longer be authorized pursuant to the Commission’s SDoC processes, and the 
equipment of any of these entities would have to be processed pursuant to the Commission’s certification 
rules and processes as proposed above. Accordingly, responsible parties would be prohibited altogether 
from using the SDoC process with respect to any equipment produced or provided, in whole or part, by 
these entities (or their respective subsidiaries or affiliates), and such equipment would be prohibited from 
utilizing the SDoC process. That is not to say that all equipment produced or provided by these entities 
currently subject to the SDoC process would be prohibited; as we discussed above, under our current 


177 47 CER § 2.906(c). 


178 See 47 CFR §§ 2.906 (“Supplier’s Declaration of Conformity”); 2.9391 (“Responsibilities”); 2.938 (“Retention 
of records”); 2.945 (“Submission of equipment for testing and equipment records”); 2.1071-1077 (“Supplier’s 
Declaration of Conformity”). 


179 47 CFR § 2.909(b)(1)-(2). 
180 47 CFR § 2,909(b)(3)-(4). 
181 47 CFR § 2.1072(a). 

182 47 CFR § 2.906(a). 


183 47 CFR § 2.1074. The format of “unique identifier” is at the responsible party’s discretion and has no correlation 
to a Commission established FCC ID. 


184 47 CFR § 2.938. 


185 47 CFR §§ 2.906(a); 2.945(b)(1) (Commission may request that the responsible party or any other party 
marketing the equipment submit a sample); 2.945(c) (upon request by the Commission, each responsible party shall 
submit copies of records required under the Commission’s rules, including — the original design drawings and 
specification; procedures for inspection and testing; test results; actual date of testing; name of the test lab, company, 
or individual performing the testing; description of the equipment; and/or the “compliance information” required 
under the rules). See 47 CFR § 2.1077 (Compliance information). The Commission’s rules include procedures 
wherein the Commission can suspend action on application or require forfeiture. See 47 CFR §§ 2.945(b)(5), 
2.945(c). Upon request by the Commission, each responsible party must make its manufacturing plant and facilities 
available for inspection. 47 CFR § 2.945(d). 
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tules, responsible parties always have the option of seeking equipment authorization through the 
Commission’s equipment certification procedures. Under our proposed rules, responsible parties would 
now be required to use the certification procedures for any equipment produced or provided by these 
entities, as the option of using the SDoC processes would no longer be available. This proposal will help 
ensure consistent application of our proposed prohibition on further equipment authorization of any 
“covered” equipment by requiring use of only one process, which includes the Commission’s more active 
oversight and proactive guidance when working directly with TCBs prior to any equipment authorization 
in the first place, and in guiding appropriate post-market surveillance after any equipment authorization. 
We find this approach consistent with the public interest. 


60. We seek comment on the specific information that must be included in the SDoC 
compliance statement that will ensure that responsible parties do not use the SDoC process for “covered” 
equipment. This compliance statement would need to be sufficiently complete to require a responsible 
party to exercise necessary diligence with respect to the equipment that it is subjecting to the SDoC 
process that will ensure that it is attesting, in clear terms, that the equipment (or any component part 
thereof) is not produced or provided by any entity that has produced or provided “covered” equipment on 
the Covered List. This compliance statement should be crafted in such as manner as to assist responsible 
parties in identifying equipment that can no longer be processed through the SDoC process while also 
ensuring that responsible parties are held accountable, by their compliance statement, for any 
misrepresentations or violation of the prohibition that we are proposing. We note that current rules 
require that the responsible party be located within the United States.'’° As discussed above regarding 
equipment subject to our certification process, should we also require that the compliance statement 
include the name of a U.S. agent for service of process (if different from the responsible party)? 


61. What steps should the Commission take to help inform responsible parties that use the 
SDoC process of this proposed prohibition, as well as the requirement that any equipment (including 
component parts) produced or provided by entities (and their subsidiaries and affiliates) that produce or 
provide “covered” equipment must be subject to the equipment certification process? We note that our 
tules allow many entities to take on the role of a responsible party under our part 2 rules, including 
retailers and parties performing modifications to equipment. We seek comment on how best to ensure 
that all responsible parties that use the SDoC processes to enable importing or marketing of equipment in 
the United States will understand and comply with our proposed revisions with respect to equipment 
produced or provided by entities that produce or provide “covered” equipment on the Covered List. What 
types of actions or activities (e.g., outreach and education) to equipment manufacturers, assemblers, 
importers, retailers, parties performing modification under certain circumstances, and others that serve as 
responsible parties and use the SDoC process regarding particular equipment would be advised and most 
helpful? Should we impose a similar requirement with respect to existing authorizations obtained through 
the SDoC process? If so, how would we do so? If not, how should we address the difficulty of obtaining 
service of process on certain foreign-based equipment manufacturers? 


62. As noted above, the Commission can specifically request that the responsible parties 
provide information on any equipment to the Commission that has been authorized through the SDoC 
process.'8? Under our proposal, in an effort to ensure that responsible parties are complying with our 


186 47 CFR § 2.1077(a)(3). 


187 47 CFR §§ 2.906(a); 2.945(b)(1) (Commission may request that the responsible party or any other party 
marketing the equipment submit a sample); 2.945(c) (upon request by the Commission, each responsible party shall 
submit copies of records required under the Commission’s rules, including — the original design drawings and 
specification; procedures for inspection and testing; test results; actual date of testing; name of the test lab, company, 
or individual performing the testing; description of the equipment; and/or the “compliance information” required 
under the rules). See 47 CFR § 2.1077 (Compliance information). The Commission’s rules include procedures 
wherein the Commission can suspend action on application or require forfeiture. See47 CFR §§ 2.945(b)(5), 
2.945(c). Upon request by the Commission, each responsible party must make its manufacturing plant and facilities 
available for inspection. 47 CFR § 2.945(d). 
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prohibition, the Commission would exercise its equipment authorization oversight, as appropriate, in 
requesting that the responsible parties provide information — e.g., an equipment sample, representative 
data demonstrating compliance, and the compliance statement itself — regarding particular equipment to 
the Commission. We seek comment on what kinds of situations in which such requests might be 
appropriate. What kinds of information might inform the Commission’s consideration as to whether any 
equipment may have been inappropriately processed through the SDoC process, thus triggering the 
Commission’s request for information from the responsible party to make sure that no violation of the 
Commission’s prohibition have occurred? 


63. As we have discussed, PSHSB will periodically publish updates to identify the “covered” 
equipment on the Covered List.!8 As with the equipment certification proposals above, we would direct 
that OET expeditiously take all the appropriate steps (e.g., updating as necessary the information that 
SDoC applicants must make to establish that no newly identified “covered” equipment is associated with 
the application to reflect those updates), consistent with the rules and procedures that the Commission 
ultimately adopts regarding the SDoC rules in this proceeding. We invite comment on appropriate means 
for OET to include updates of the “covered” equipment in an expeditious fashion in ways that best ensure 
that applicants, responsible parties, and other interested parties will comply with the prohibitions that we 
have proposed. 


64. Finally, we seek comment on whether there are other rule revisions or clarifications to the 
SDoC rules and processes that the Commission should make consistent with our goals to prohibit 
authorization of “covered” equipment. Commenters should explain their suggestions in sufficient detail, 
including the reasoning behind the suggestions and associated issues (e.g., implementation). 


(iv) Legal authority 


65. Adopting rules that take security into consideration in the equipment authorization 
process would serve the public interest by addressing significant national security risks that have been 
identified by this Commission in other proceedings, and by Congress and other federal agencies, and 
doing so would be consistent with the Commission’s statutory “purpose of regulating interstate and 
foreign commerce in communication by wire and radio ... for the purpose of the national defense [and] 
for the purpose of promoting safety of life and property through the use of wire and radio 
communications.”!%? We tentatively conclude that doing so is not specifically authorized by the Secure 
Networks Act itself, pursuant to which the Commission adopted the Covered List. However, the 
Commission has broad authority to adopt rules, not inconsistent with the Communications Act, “as may 
be necessary in the execution of its functions.”'%° We believe that, in order to ensure that the 
Commission’s rules under the Secure Networks Act effectively preclude use of equipment on the Covered 
List by USF recipients as contemplated by Congress, it is necessary to rely on the Commission’s 
established equipment authorization procedures to restrict further equipment authorization, and the 
importation and marketing, of such devices in the first instance. As discussed above,!*! the Commission 
also relies on the equipment authorization process to implement other statutory duties, including the duty 
to promote efficient use of the radio spectrum,'” our duties under the National Environmental Policy Act 
to regulate human RF exposure,'®? our duty to ensure that mobile handsets are compatible with hearing 


'88 Covered List Public Notice at 2. 
18 47 U.S.C. § 151. 

1% 47 U.S.C. § 154(i). 

191 See supra paragraph 23. 


192 47 CFR § 2.901; see 47 U.S.C. § 303(g) (requiring the Commission to “generally encourage the larger and more 
effective use of radio in the public interest”). 


193 47 CFR §§ 2.1091-.1093. 
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aids,'** and our duty to deny federal benefits to certain individuals who have been convicted multiple 
times of federal offenses related to trafficking in or possession of controlled substances.'> We believe 
that these processes can and should also serve the purpose of fulfilling other Commission responsibilities 
under the Secure Networks Act, and we seek comment on that issue. 


66. We also believe that other authorities in the Communications Act of 1934, as amended, 
provide authority for the Commission to rely on for the proposed modifications to its rules and procedures 
governing equipment authorization. Since Congress added section 302 to the Act, the Commission’s part 
2 equipment authorization rules and processes have served to ensure that RF equipment marketed, sold, 
imported, and used in the United States complies with the applicable rules governing use of such 
equipment.'%° That section authorizes the Commission to, “consistent with the public interest, 
convenience, and necessity, make reasonable regulations ... governing the interference potential of 
devices which in their operation are capable of emitting radio frequency energy by radiation, conduction, 
or other means in sufficient degree to cause harmful interference to radio communications.”!9” 
Regulations that we adopt in implementing that authority “shall be applicable to the manufacture, import, 
sale, offer for sale, or shipment of such devices and ... to the use of such devices.” '°8 The authorization 
processes are primarily for the purpose of evaluating equipment’s compliance with technical 
specifications intended to minimize the interference potential of devices that emit RF energy. As noted 
above, however, these rules are also designed to implement other statutory responsibilities. We seek 
comment on the scope of our authority to rely on such rules to effectuate other public interest 
responsibilities, including our section 303(e) authority to “[r]egulate the kind of apparatus to be used with 
respect to its external effects.”! Does Congress’s inclusion of the phrase “to be used,” rather than 
“used,” give the Commission authority to prevent the marketing and sale of equipment in addition to 
preventing licensees and others from using such equipment? 


67. Alternatively, does the “public interest” phrase in section 302 itself provide independent 
authority to deny equipment authorization to equipment deemed to pose an unacceptable security risk? 
Section 302(a) directs the Commission to make reasonable regulations consistent with the public interest 
governing the interference potential of devices; it would appear to be in the public interest not to approve 
devices capable of emitting RF energy in sufficient degree to cause harmful interference to radio 
communications if such equipment has been deemed, pursuant to law, to pose an unacceptable risk to the 
national security of the United States or the security and safety of United States persons. We seek 
comment on this tentative conclusion. 


68. We note and seek comment on a potential alternative basis for such security rules. The 
Communications Assistance for Law Enforcement Act (CALEA)® includes security requirements that 
apply directly to equipment intended for use by providers of telecommunications services.”°! Section 105 
requires telecommunications carriers to ensure that the surveillance capabilities built into their networks 


194 47 CFR §§ 2.925(b)(2), 2.1033(d); see 47 U.S.C. § 610. 
195 47 CFR § 1.2002(a); see 21 U.S.C. § 862 (Anti-Drug Abuse Act of 1988). 


196 See Equipment Authorization of RF Devices, Docket No. 19356, Report and Order, 39 Fed. Reg. 5912, 5912, 
para. 2 (1970). 


197 47 U.S.C. § 302(a)(1). 
198 47 U.S.C. § 302(a)(2). 
19 47 U.S.C. § 303(e). 

200 47 U.S.C. §§ 1001-1010. 


201 For this purpose, telecommunications service includes facilities-based broadband Internet access services and 
interconnected VoIP services, notwithstanding the classification of those services under the Communications Act. 
See Communications Assistance for Law Enforcement Act and Broadband Access and Services, ET Docket No. 04- 
295, First Report and Order and Further Notice of Proposed Rulemaking, 20 FCC Red 14989 (2005), pet. for rev. 
denied, American Council on Educ. v. FCC, 451 F.3d 226 (D.C. Cir. 2006). 
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“can be activated only in accordance with a court order or other lawful authorization and with the 
affirmative intervention of an individual officer or employee of the carrier acting in accordance with 
regulations prescribed by the Commission,” and the Commission has concluded that its rule prohibiting 
the use of equipment produced or provided by any company posing a national security threat implements 
that provision.2°° The Commission is required to prescribe rules necessary to implement CALEA’s 
requirements.”* Would rules prohibiting authorization of equipment on the Covered List, or that 
otherwise poses security risks, be justified as implementation of CALEA? 


69. As noted above, we believe the Commission has ancillary authority under section 4(i) of 
the Act to adopt these revisions to its part 2 rules as reasonably necessary to the effective enforcement of 
the Secure Networks Act. We also tentatively conclude that such rules would be consistent with our 
specific statutorily mandated responsibilities under the Communications Act to make reasonable 
regulations consistent with the public interest governing the interference potential of electronic devices, to 
protect consumers through our oversight of common carriers under Title II of that Act, and to prescribe 
the nature of services to be rendered by radio licensees under section 303(b) of that Act. We seek 
comment on this reasoning as well. We also seek comment on any other sources of authority for our 
proposed rules. 


(v) Cost-effectiveness analysis 


70. Our proposed revisions to the Commission’s equipment authorization rules and processes 
to prohibit authorization of any “covered” equipment on the Covered List would apply only to equipment 
that has been determined by other agencies to pose “an unacceptable risk” to national security. The 
Commission has already concluded that it has no discretion to disregard determinations from these 
sources, which are enumerated in section 1.50002(b) of its rules. Hence, we accept the determination of 
these expert agencies. 


71. Because we have no discretion to ignore these determinations, we believe that a 
conventional cost-benefit analysis — which would seek to determine whether the costs of our proposed 
actions exceed their benefits — is not directly called for. Instead, we will consider whether the proposed 
actions would be a cost-effective means to prevent this dangerous equipment from being introduced into 
our nation’s communications networks. 


72. We therefore seek comment on the cost-effectiveness of our proposed revisions to the 
rules and procedures associated with the Commission’s equipment authorization rules under part 2. Do 
our proposed rules promote our goals of ensuring that our national security interests are adequately 
protected from equipment on the Covered List, while simultaneously continuing our mission of making 
communications services available to all Americans? Are there alternative approaches that would achieve 
this goal in a more cost-effective manner? 


b. Devices Exempt from the Requirement of an Equipment 
Authorization 
73. Background. Under the Commission’s rules, certain types of RF devices, are exempt 


from demonstrating compliance under one of the equipment authorization procedures (either certification 
or SDoC).”°° This exemption applies to specified digital devices in several types of products, including 


202 47 U.S.C. § 1004. 
203 Supply Chain First Report and Order, 34 FCC Rcd at 11436-37, paras. 35-36. 
204 47 U.S.C. § 229. 


205 For example, devices described in section 15.103 are not subject to any equipment authorization procedures. 
Similarly, section 90.203 generally requires all devices that operate under that part to be certified but contains 
provisions that exempts certain devices from that requirement. Under Part 25, only portable earth station 
transceivers are subject to equipment certification procedures; all other Part 25 equipment is exempt for equipment 
authorization procedures. See 47 CFR § 25.129. Also, under Part 97 only external power amplifiers used in the 
(continued. ...) 
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many part 15 devices (including incidental and unintentional radiators) because they generate such low 
levels of RF emission that they have virtually no potential for interfering with authorized radio services.?° 
In other services, the Commission has determined that because operators must be individually licensed 
and responsible for their stations (e.g., Amateur Radio Service) or the type of operation poses low risk of 
harmful interference, such an exemption is warranted.” Exempt devices are required to comply with 
general conditions of operation,”°* including the requirement that if an exempt device causes interference 
to other radio services the operator of that device must cease operating the device upon notification from 
the Commission and must remedy the interference. 


74. The most diverse set of exempted devices operate under our part 15 unlicensed device 
rules. The categories of part 15 exempt devices include incidental radiators,” unintentional radiators 
exempt under section 15.103,?!° and subassemblies exempt under section 15.101.7!'! Specifically, section 
15.103 of the Commission’s rules provides that certain unintentional radiators, which are subject to the 
general conditions of operation provided in part 15,?!? are exempt from the specific technical standards 
and other requirements of part 15. This includes: (1) digital devices used exclusively in any 
transportation vehicle as an electronic control or power system equipment used by a public utility or in an 
industrial plant, as industrial, commercial, or medical test equipment, or in an appliance (e.g., microwave 
oven, dishwasher, clothes dryer, air conditioner, etc.); (2) specialized medical digital devices; (3) digital 
devices that have very low power consumption (i.e., not exceeding 6 nW); (4) joystick controllers or 
similar devices used with digital devices; and (5) digital devices that both use and generate a very low 
frequency (i.e. less than 1.705 MHz) and which do not operate from the AC power lines or contain 
provisions for operation while connected to the AC power lines.?!> Digital device subassemblies also are 
exempt from equipment authorization under section 15.101. Examples of subassemblies include circuit 
boards, integrated circuit chops, and other components that are completely internal to a product that do 
not constitute a final product. These include internal memory expansion boards, internal disk drives, 
internal disk drive controller boards, CPU boards, and power supplies. Subassemblies may be sold to the 
general public or to manufacturers for incorporation into a final product. 


75. Discussion. We recognize that “covered” equipment potentially could include equipment 
that currently is exempt from the need to demonstrate compliance under the Commission’s equipment 
authorization processes, which, to date, has looked only at the RF emissions capability of equipment. As 
noted above, most devices that are generally exempt from the Commission’s equipment authorization 
requirements typically have such low RF emissions that they present virtually no potential for causing 
harmful interference to with the authorized radio services. However, our concerns in relation to security 
considerations that pose unacceptable risks to our nation’s communications networks are distinct from our 
concerns related to interference to authorized services. As such, we find it necessary to assess our 
regulation of otherwise exempt devices in relation to security concerns. 


Amateur Radio Service are required to obtain equipment certification; all other equipment is exempt from 
equipment authorization procedures. See 47 CFR § 97.315. 


206 Revision of Part 15 of the Rules Regarding the Operation of Radio Frequency Devices without an Individual 
License, GN Docket No. 87-389, Notice of Proposed Rulemaking, 2 FCC Red 6135, 6140, para. 39 (1987). 


207 See, e.g., 47 CFR § 97.315. 
208 See 47 CFR § 15.5. 


209 An incidental radiator is a device that generates RF energy during the course of its operation although the device 
is not intentionally designed to generate or emit RF energy. 47 CFR § 15.3(n). 


210 47 CFR § 15.103. 
211 47 CFR § 15.101. 
212 See 47 CFR §§ 15.5, 15.29. 
213 47 CFR § 15.103. 
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76. Accordingly, we seek comment on whether the Commission should consider possible 
revisions or clarifications to the Commission’s rules to address issues related to “covered” equipment and 
the potential of such equipment, regardless of RF emissions characteristics, to pose an unacceptable risk 
to U.S. networks or users. We seek comment on whether the Commission should revise its rules to no 
longer provide an equipment authorization exemption to “covered” equipment. We seek comment on 
whether such a provision, if adopted, should apply only to part 15 unlicensed devices or should include 
any device, regardless of rule part under which it operates, in our consideration of possible revisions or 
clarifications to the Commission’s rules to address issues related to “covered” equipment and the potential 
of such equipment, regardless of RF emissions characteristics, to nonetheless pose an unacceptable risk to 
U.S. networks or users. We also ask whether we should require that any equipment (in whole or in part), 
regardless of claim of exemption, that is produced or provided by any entity that has produced or 
provided “covered” equipment on the Covered List to be processed pursuant to the Commission’s 
certification rules and processes (similar to our proposal requiring use of the certification process for such 
equipment instead of continued use of the SDoC process). 


71. Currently, devices that are exempt from the equipment authorization requirement are not 
subject to FCC testing, filing, or record retention requirements. Such devices ordinarily would come to 
the attention of the Commission only in the event that harmful interference with other devices becomes an 
issue. In order to determine whether otherwise exempt “covered” equipment may present a security 
concern, the Commission would need to implement some means by which to identify such equipment that 
is in use in the United States. We seek comment on possible methods that the Commission could 
implement to identify otherwise exempt equipment. We could, for instance, implement a registration 
system for otherwise exempt equipment produced or provided by any of the entities (or their respective 
subsidiaries or affiliates) that produce or provide “covered” equipment, as specified on the Covered List. 
Such a system could require that relevant responsible parties notify the Commission of the marketing, 
importation, or operation of such otherwise exempt equipment. Such notification would include 
identification of the responsible party, manufacturer, or importer and the general operating parameters of 
the equipment. Another example includes an attestation at time of marketing or import that the 
equipment is not “covered.” What are some potential burdens to responsible parties or other entities that 
would arise in connection with such a registration or attestation system? In what ways and to what extent 
would such burdens be acceptable to responsible parties to help protect the U.S. against the related 
security concerns? What type of information, and from which entities, should the Commission collect in 
order to identify otherwise exempt “covered” equipment? How many responsible parties would be 
impacted by these potential information collections and in what way would it impact their ability to 
conduct business? Ifthe Commission were to revise its rules to remove the exemption with respect to 
“covered” equipment, we seek comment any other types of action or activity (e.g., outreach and 
education) that also would be helpful to ensure that all parties potentially affected by these changes 
understand the changes and will comply the prohibition associated with “covered” equipment. 


78. We discussed above the legal authority associated with the Commission’s proposal to 
prohibit authorization of “covered” equipment in its equipment authorization process. We tentatively 
conclude legal bases enunciated above also provide, pursuant to Section 302 and Section 4(1) of the Act, 
for actions that the Commission might take with respect to precluding “covered” equipment from being 
exempted from the equipment authorization process. We seek comment on this tentative conclusion. 


79. If we were to conclude that our rules should be revised to prohibit certain “covered” 
equipment from being exempted from the equipment authorization processes, this action would apply 
only to equipment that has been determined by other agencies to pose “an unacceptable risk” to national 
security. Because we have no discretion to ignore these determinations, we believe that a conventional 
cost-benefit analysis — which would seek to determine whether the costs of our proposed actions exceed 
their benefits — is not necessary. Instead, as we have discussed above, we will consider whether the 
proposed actions would be an effective means to prevent this dangerous equipment from being introduced 
into our nation's communications networks. 
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c. Revoking Equipment Authorizations 


80. The actions that we propose above would serve to prohibit any prospective authorization 
of “covered” communications equipment on the Covered List as posing an unacceptable risk to national 
security. Those proposed actions do not, however, address whether the Commission could or should 
revoke any existing equipment authorizations of such “covered” communications equipment, and if so, 
the processes for doing so. We address those issues here. 


81. Background. Section 2.939 sets forth the Commission’s rules for revoking authorizations 
of equipment.?!* Section 2.939(a)(1) provides that the Commission may revoke an equipment 
authorization “[f]or false statements or representations either in the application or in materials or response 
submitted in connection therewith” or in records that the responsible party is required to maintain about 
the authorized equipment (e.g., drawings and specifications, description of the equipment, any test report, 
equipment compliance information).7!> Section 2.939(a)(2) states that the Commission may revoke an 
equipment authorization “[i]f upon subsequent inspection or operation it is determined that the equipment 
does not conform to the pertinent technical requirements or to the representations made in the original 
application.”?' Section 2.939(a)(3) provides that the Commission may revoke an equipment 
authorization “[i]f it is determined that changes have been made in the equipment other than those 
authorized by the rules or otherwise expressly authorized by the Commission.”?!7 Section 2.939(a)(4) 
provides that the Commission may revoke any equipment authorization “[b]ecause of conditions coming 
to the attention of the Commission which would warrant it in refusing to grant an original application.”?!® 
As set forth in section 2.939(b), the procedures for revoking an equipment authorization are the same 
procedures as revoking a radio station license under Section 312 of the Communications Act.?'9 Finally, 
under section 2.939(c), the Commission also “may withdraw any equipment authorization in the event of 
changes in its technical standards.” 


82. Discussion. If we adopt the rules proposed above to prohibit any further authorization of 
“covered” equipment on the Covered List, we seek comment here on the extent to which the Commission 
should revoke any existing equipment authorizations of such “covered” equipment pursuant to our section 
2.939 revocation rules. We note that if the Commission revoked an existing equipment authorization, the 
marketing of that equipment would be prohibited pursuant to part 2 Subpart I, per section 2.803(b),”?! and 
import and marketing would be prohibited pursuant to part 2 Subpart K, per sections 2.1201(a) and 
2.1204(a).?22 


83. We tentatively conclude that Sections 2.939(a)(1) and (2) would apply to “covered” 
equipment,??? such that the Commission has authority to revoke any existing equipment authorizations 


214 47 CFR § 2.939. 


215 47 CFR § 2.939(a)(1). The “responsible party” is required to maintain records relating to authorized equipment 
pursuant to section 2.938 of the Commission’s equipment authorization rules, 47 CFR § 2.938, and which includes 
compliance information as specified in section 2.1077 of the Commission’s rules, 47 CFR § 2.1077. 


216 47 CFR § 2.939(a)(2). 
217 47 CER § 2.939(a)(3). 
218 47 CFR § 2.939(a)(4). 
219 See 47 CFR § 2.939(b); 47 U.S.C. § 312. 


220 47 CFR § 2.939(c). The procedure to be followed will be set forth in the order promulgating such new technical 
standards (after appropriate rulemaking proceedings) and will provide a suitable amortization period for equipment 
in hands of users and in the manufacturing process. Id. 


221 47 CFR § 2.803(b). 
222 47 CFR §§ 2.1201 (a), 2.1204(a). 
223 47 CFR § 2.939(a)(1)-(2). 
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that may have been granted under false statements or representations (including non-disclosure) 
concerning whether, an equipment authorization application that was subsequently granted had in fact 
included “covered” equipment (in whole or as a component part).? This would enable the Commission 
to revoke any equipment authorizations that are granted after adoption of the rules proposed in this 
Notice, even if the TCBs or the Commission had not acted to set aside the grant within the 30-day period 
following the posting of the grant on the Equipment Authorization System (EAS) database. We seek 
comment on this tentative conclusion. 


84. To assure that otherwise authorized equipment is not subsequently replaced by any 
“covered” equipment (whether in whole or with component part(s) of “covered” equipment), we also 
tentatively conclude that section 2.939(a)(3) would apply, and that the Commission can revoke an 
existing equipment authorization if changes have been made in the equipment other than those authorized 
by the rules or otherwise expressly authorized by the Commission.”> We seek comment on these and any 
other scenarios that implicate our need to revoke an existing equipment authorization to exclude 
“covered” equipment from the U.S. market. 


85. We also seek comment on other circumstances that would merit Commission action to 
revoke any existing authorization of “covered” equipment. Under what circumstances should the 
Commission revoke an existing authorization? For instance, to what extent does section 2.939(a)(4), 
which allows revocation “[b]ecause of conditions coming to the attention of the Commission which 
would warrant it in refusing to grant an original application,”*° provide guidance? Specifically, if the 
Commission would not have granted an application with equipment from an entity on the Covered List 
under newly adopted rules, then could the Commission use section 2.939(a)(4) to revoke an equipment 
authorization with said equipment that had been granted prior to the adoption of the rule???” We seek 
comment on this approach and on any other approach or particular circumstances that would merit 
Commission action to revoke any existing authorization that concerns “covered” equipment on the 
Covered List. 


86. We seek comment on the applicability of section 2.939(c), which states that the 
Commission also “may withdraw any equipment authorization in the event of changes in its technical 
standards,”??8 with regard to revocation of authorizations that include “covered” equipment. In the event 
the Commission were, as we propose here, to adopt rules barring new equipment authorizations for 
equipment on the Covered List, we tentatively conclude that such a change should constitute a change to 
the Commission’s technical standards that could warrant withdrawal of equipment authorizations that are 
contrary to these new rules. We seek comment. 


87. In addition, we seek comment on the specific procedures the Commission should use if 
and when it seeks to revoke an existing equipment authorization. Section 2.939(b) requires that 
revocation of an equipment authorization must be made in the “same manner as revocation of radio 


224 Shenzhen Tangreat Technology Co., Ltd., 30 FCC Red 3501,3505, paras. 12-14 (EB 2015) (Shenzhen) 
(“substantial and material questions exist as to whether the authorization should be revoked because the information 
in the application was false or misleading”). 


225 Shenzhen, 30 FCC Red at 3505-06, paras. 15-17 (Commission investigation demonstrated that the equipment 
marketed does not match the specifications described in the granted application). 


226 47 CFR § 2.939(a)(4). 


227 Shenzhen, 30 FCC Rcd at 3506, paras. 18-20 (when Commission investigation determined device was a radio 
frequency jammer, “substantial and material questions exist as to whether the application should have been 
granted”), see also J Communications Co., Ltd., 19 FCC Red 10643, 10645, para. 9 (EB 2004) (revoking GMRS 
radios because the Commission could have denied the original equipment authorization application for the devices 
“had this fact been made known to the Commission”). 


228 47 CFR § 2.939(c). The procedure to be followed will be set forth in the order promulgating such new technical 
standards (after appropriate rulemaking proceedings) and will provide a suitable amortization period for equipment 
in hands of users and in the manufacturing process. Id. 
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station licenses,”?”? and thus presumably would include the requirement that the Commission serve the 
grantee/responsible party with an order to show cause why revocation should not be issued and must 
provide that party with an opportunity for a hearing.° We seek comment on this requirement. What 
precisely are the procedures that the Commission should employ if seeking to revoke particular “covered” 
equipment? As we discussed above, section 2.939(c) authorizes the Commission to withdraw any 
equipment authorization in the event of changes in its technical standards.”>' Pursuant to this provision, 
should we provide a suitable amortization period for equipment already in the hands of users or in the 
manufacturing process? If so, what would that be? What other factors should we consider that might 
watrant revocation under our new rules, such as those applicable to Title III licenses under section 312 of 
the Communications Act??? Should we revise or clarify the existing requirements to enable the 
Commission to revoke authorizations of this “covered” equipment given that it already has been 
determined that the equipment poses an unacceptable risk? 


88. In considering whether any existing equipment authorizations of “covered” equipment 
should be revoked, is there some process in which the Commission should engage to help identify 
particular equipment authorizations that should be considered for revocation? What process should we 
use to identify equipment authorizations for revocation? For example, to what extent might we rely on 
others’ reports of a violation, and to what extent might such reports need to be supported in our record or 
independently verified? If we were to conclude that revocation may be appropriate regarding particular 
“covered” equipment, this action would apply only to equipment that has been determined by other 
agencies to pose “an unacceptable risk” to national security. We nonetheless recognize the need to avoid 
taking actions that are overbroad in terms of affecting users of the equipment or would require removal of 
this equipment faster than it reasonably can be replaced. If we conclude that revocation may be 
appropriate regarding particular “covered” equipment, we seek comment on the appropriate and 
reasonable transition period for removing that particular equipment. This could include a transition 
period for non-conforming equipment to make any necessary modifications to communications 
equipment or services, including removing the “covered equipment” (in whole or as a component) from 
that equipment or service. To what extent should we apply different transition periods to different 
equipment authorizations that we revoke? Are there any situations that might merit immediate 
compliance with the new equipment restrictions? Pursuant to Section 503(b)(5) of the Act?, the 
Commission must issue citations against non-regulatees for violations of FCC rules before proposing any 
monetary penalties. Such citations “provide notice to parties that one or more actions violate the Act 
and/or the FCC’s rules — and that they could face a monetary forfeiture if the conduct continues.”?*4 
Given this requirement, what enforcement policy would be appropriate for the continued marketing, sale, 
or operation of equipment by such parties during this transition period? What, if any, educational and 
outreach efforts should the Commission undertake to inform the public regarding any such revocations 
and their legal effect? 


89. Finally, we seek comment on whether the Commission should make any revisions to 
section 2.939. Should this section be revised and/or clarified to specifically include “covered” equipment 
or whether the rule should be clarified to better encompass our intent in this rulemaking? What other 
specific revisions might be appropriate for consideration? 


223 47 CFR § 2.939(b). 
230 See 47 U.S.C. § 312(c). 
231 47 CER § 2.939(c). 
232 47 U.S.C. § 312. 

233 47 U.S.C. § 503(b)(5). 


234 See Federal Communications Commission, Enforcement Bureau, “Enforcement Overview” at 10, available at 
https://www.fcc.gov/sites/default/files/public_enforcement_overview.pdf (last visited June 14, 2021). 
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2. Competitive Bidding Certification 


90. Background. The Commission’s competitive bidding process requires each applicant to 
make various certifications as a prerequisite for participation in an auction.”*> Requiring certifications as 
a condition of participation guards against potential harms to the public interest before the harms could 
occur.??6 


91. As described above, the Commission has designated Huawei and ZTE, and their 
subsidiaries, parents, or affiliates, as companies that pose a national security threat to the integrity of 
communications networks and the communications supply chain. ?5” As a result of this determination, 
funds from the Commission’s Universal Service Fund may no longer be used to purchase, obtain, 
maintain, improve, modify, or otherwise support any equipment or services produced or provided by 
these covered companies. 


92. In reaching this determination, the Commission noted Huawei’s and ZTE’s ties to the 
Chinese government and military apparatus, along with Chinese laws obligating it to cooperate with 
requests by the Chinese government to use or access its systems.”°* However, it also is well-established 
that the Chinese government helps fuel Huawei’s growth by deploying powerful industrial policies to 
make Huawei equipment cheaper to deploy than the alternatives.” These policies include both direct 
subsidies to Huawei and state-funded export financing. 


93. To illustrate, a recent report by the Center for American Progress found that China’s 
state-owned banks have provided billions of dollars to Huawei’s customers.”#° According to the report, 
these loans “can make Huawei impossible to beat — even if competitors can match the company’s state- 
subsidized prices — because China’s state banks offer packages that commercial banks generally cannot 
match.”*4! These loans may be run through Huawei or provided directly to Huawei’s customers. 


94. We note that the nature of state support for Huawei and ZTE has shifted over time. 
Recently, the Commission has observed how state-funded export financing may provide substantial 
funding to mobile operators already using equipment from Huawei or ZTE prior to national spectrum 
auctions in other countries. In one recent case, a Huawei customer was able to substantially outbid a rival 
new entrant in a spectrum auction — thereby denying entry to a new competitor that was planning on using 
trustworthy equipment in its 5G build-out. 


95. Distortionary financing intended to support participation in spectrum auctions of network 
operators who then deploy covered equipment and services may raise concerns about risks to the national 
security of the United States and the security and safety of United States persons. We consider here the 
benefits of protecting against such risks prior to the start of a Commission auction. 


96. Discussion. Given recent developments internationally, we seek comment on whether 
the Commission should require an applicant to participate in competitive bidding to certify that its bids do 
not and will not rely on financial support from any entity that the Commission has designated under 
Section 54.9 of its rules as a national security threat to the integrity of communications networks or the 


235 See Section II.C., above. 


236 This timing also furthers the public interest in rapid deployment of new technologies, products, and services by 
protecting against subsequent license application denials and repetitive assignments of the same licenses. 


237 See generally Huawei Designation Order, 35 FCC Red 6604, ZTE Designation Order, 35 FCC Red 6633. 
238 Huawei Designation Order, 35 FCC Rcd at 6609, paras. 13-14. 


239 Chuin-Wei Yap, State Support Helped Fuel Huawei’s Global Rise, Wall Street Journal (Dec. 25, 2019), 
https://www.ws}.com/articles/state-support-helped-fuel-huaweis-global-rise- 11577280736. 


24 Melanie Hart and Jordan Link, Center for American Progress, There Is a Solution to the Huawei Challenge (Oct. 
14, 2020), https://www.americanprogress.org/issues/security/reports/2020/10/14/49 1476/solution-huawei-challenge/ 


241 Td. at para. 25. 
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communications supply chain. Could such support implicate the kinds of influence over the applicant 
that would pose risks to national security? Or could it distort auction outcomes in ways that would pose 
risks to national security? What challenges would an applicant have in satisfying such a certification, 
given potential uncertainties regarding the ultimate origin of financial support? Can the certification be 
crafted to address these challenges? Do these uncertainties present difficulties for the Commission in 
enforcing the certification? How can these difficulties be mitigated? 


97. If we adopt a requirement that an applicant certify that its bids do not and will not rely on 
financial support by an entity designated by the Commission as a national security threat, should the 
certification be limited to just the entities so designated by the Commission under Section 54.9 or be more 
expansive? What are the challenges with including indirect provision of financing in the certification and 
how can they be mitigated to ensure it accomplishes its purpose? Should the certification be expanded to 
include an identified set of related entities, e.g., entities subject to control by an entity designated by the 
Commission? What entities should such a set include? How does the fungibility of financial resources 
complicate compliance? How can enforcement challenges be alleviated? 


B. Notice of Inquiry 


98. The above Notice of Proposed Rulemaking proposes direct action to limit the presence of 
untrusted equipment and services in U.S. networks. We recognize, however, that ensuring continued U.S. 
leadership requires that we also explore opportunities to spur trustworthy innovation for more secure 
equipment. In this Notice of Inquiry, we seek comment on how the Commission can leverage its 
equipment authorization program to encourage manufacturers who are building devices that will connect 
to U.S. networks to consider cybersecurity standards and guidelines. 


99. The development and implementation of effective cybersecurity practices requires the 
continued cooperation and participation of all stakeholders. In this regard, we observe that both the 
public and private sectors have come together to develop measures to protect the integrity of 
communications networks and guard against malicious or foreign intrusions that can compromise network 
services, steal proprietary information, and harm consumers. In particular, the National Institute of 
Standards and Technology (NIST) has worked with both industry and government to produce multiple 
cybersecurity frameworks and other forms of guidance that help protect the integrity of communications 
networks. Pursuant to Executive Order No. 13636, NIST began working with public and private 
stakeholders to develop a voluntary cybersecurity framework designed to reduce risks to critical 
infrastructure.*” This framework consists of “voluntary guidance, based on existing standards, 
guidelines, and practices for organizations to better manage and reduce cybersecurity risk.” Originally 
issued in 2013, the NIST cybersecurity framework was updated in 2018 to clarify and refine certain 
aspects and better explain how entities should use the framework to improve their cybersecurity 
practices.” In addition, among other organizations, the Federal Trade Commission has been active in 
cybersecurity matters for years, bringing multiple enforcement actions against firms for having poor 
cybersecurity practices™ and offering cybersecurity guidance for Internet of Things (IoT) devices as 


242 Exec. Order No. 13636, 78 Fed. Reg. 11737 (Feb. 19, 2013; see Nat’l Inst. of Standards & Tech., Cybersecurity 
Framework: New to Framework (last updated Sept. 23, 2020), https://www.nist.gov/cyberframework/new- 
framework. 


243 See Natl Inst. of Standards & Tech., Cybersecurity Framework: New to Framework (last updated Sept. 23, 
2020), https:/Awww.nist.gov/cyberframework/new-framework. 


244 See Nat'l Inst. of Standards & Tech., Framework for Improving Critical Infrastructure Cybersecurity: Version 
1.1 (Apr. 16, 2018), https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf. 


245 See, e.g., Fed. Trade Comm’n v. Wyndham Worldwide Corp., 799 F.3d 236 (2015) (affirming a complaint 
brought against Wyndham Worldwide Corp. for poor cybersecurity practices on the hotel chain’s information 
systems that resulted in the theft of hundreds of thousands of consumers’ personal and financial data); Press Release, 
FTC Gives Final Approval to Lenovo Settlement, Fed. Trade Comm’n (Jan. 2, 2018), https://www.ftc.gov/news- 
(continued. ...) 
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early as 2015.**° Further, industry trade groups, including CTIA—The Wireless Association,” GSMA,” 

the ioXt Alliance,” and TIA?°° have produced cybersecurity guidance applicable to various sectors of the 
communications industry. Non-profit standards bodies and think tanks have also produced cybersecurity 

guidance that could be useful to the communications industry.?5! 


100. More recently, NIST has developed a Cybersecurity for IoT Program, which specifically 
“supports the development and application of standards, guidelines, and related tools to improve the 
cybersecurity of connected devices and the environments in which they are deployed.”**? Devices that 
operate as part of the IoT specifically raise concerns about security risks. For example, NTIA has 
recognized that connected devices in the IoT can extend the scope and scale of automated, distributed 
attacks. 


101. This Cybersecurity for IoT program has produced multiple reports, but perhaps most 
notable is Internal Report 8259, released in May 2020.254 This NIST IoT Report details activities that “can 
help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce 
the prevalence and severity of IoT device compromises and the attacks performed using compromised 
devices.”5> The NIST IoT Report is voluntary guidance intended to help promote the best available 
practices for mitigating risks to IoT security. The report describes six recommended foundational 
cybersecurity activities that manufacturers should consider performing to improve the securability of the 
new IoT devices they make. They include identifying expected customers and users and defining 
expected use cases; researching customer cybersecurity needs and goals; determining how to address 
customer needs and goals; planning for adequate support of customer needs and goals; defining 
approaches for communicating to customers; and deciding what to communicate to customers and how to 


events/press-releases/2018/01/ftc-gives-final-approval-lenovo-settlement (approving a settlement stemming from a 
complaint about pre-loaded software on laptops that compromised security protections in order to deliver ads to 
consumers). 


246 Fed. Trade Comm’n, Careful Connections: Building Security in the Internet of Things (Jan. 2015), 
https://www.bulkorder.ftc. gov/system/files/publications/pdf0199-carefulconnections- 
buildingsecurityinternetofthings.pdf. 


247 CTIA-The Wireless Assoc., IoT Cybersecurity Certification Program Management Document: Version 1.1 (May 
2019), https://api.ctia.org/wp-content/uploads/2019/05/ctia_IoT_cybersecurity_pmd_ver-1_1.pdf. 


248 Jenny Lu, Maintaining a Robust Device Identity System: Introducing the GSMA TAC and IMEI Integrity 
Framework, GSMA (Sept. 11, 2019), https://www.gsma.com/services/2019/09/11/tac-and-imei-integrity- 
framework/. 


49 ioXt All., ioXt Certification Program (last visited May 21, 2021), https://www.ioxtalliance.org/get-ioxt-certified. 


250 Telecomm. Indus. Ass’n, SCS 9001: The First ICT-Specific Standard for Global Supply Chain Security (last 
visited May 21, 2021), https://tiaonline.org/what-we-do/technology-programs/supply-chain-security/scs-9001-ict- 
specific-standard-for-global-supply-chain-security/ (noting that Version 1.0 of the standard will be released in Q3 
2021). 


251 See, e.g., Internet Soc’y, Internet of Things (IoT) Trust Framework v2.5 (May 22, 2019), 
https://www.internetsociety.org/resources/doc/2018/iot-trust-framework-v2-5/. 


252 Nat’| Inst. of Standards & Tech., NIST Cybersecurity for IoT Program (last updated Mar. 19, 2021), 
https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program. 


253 https://www.ntia.doc. gov/files/ntia/blogimages/botnet_road_map_status_update.pdf. 


254 Nat’l Inst. of Standards & Tech., Foundational Cybersecurity Activities for IoT Device Manufacturers, Internal 
Report 8259 (May 2020) (NIST IoT Report), https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8259. pdf. 


255 Jd. In the NIST IoT Report, six activities are suggested to help manufacturers produce IoT devices with better 
cybersecurity, four of which primarily impact the pre-market phase — before the IoT devices have been sold — while 
the other two primarily impact the post-market phase — after the devices have been sold. Substantial guidance and 
examples are provided for each of these suggested activities. Jd. at 6-23. 
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communicate it. These activities are intended to fit within a manufacturer’s existing development 
process. 


102. | We seek comment on how the Commission can leverage its equipment authorization 
program to help address the particular security risks that are associated with IoT devices. Should the 
Commission encourage manufacturers of IoT devices to follow the guidance in the NIST IoT Report? If 
the Commission were to utilize the equipment authorization process to incentivize better cybersecurity 
practices, either for all devices or specifically for IoT devices, what form should such provisions take and 
how would such a program be structured most effectively? Should the FCC allow IoT manufacturers to 
voluntarily certify during the equipment authorization process that they have performed or plan to 
perform the activities described in the guidance? Are there other technologies or cybersecurity methods 
that mitigate security risks (e.g., RF fingerprinting”°* or some other method)? What, if anything, should 
the Commission be doing to encourage development and adoption of such technologies or methods? 
Which standards should be considered? Are there other incentives or considerations that could encourage 
manufacturers to build security into their products? Commenters should discuss the potential costs and 
benefits associated with their proposals or with the potential approaches discussed herein. 


103. Even with broad adoption of industry best practices and standards, some equipment sold 
in the United States may lack appropriate security protections. What is the role of retailers in voluntarily 
limiting the sale of such equipment? How can retailers educate consumers about the importance of 
security protections for their devices? We also seek to understand developments in international 
standards-setting bodies? What is the status of international standards setting that could be relevant to 
supply chain security, and what can the FCC do to encourage action by international standards-setting 
bodies and participation by American companies in their efforts? 


104. We observe that the Consumer Technology Association (CTA) published a white paper 
offering guidance for how government, industry, and consumers can all work together to promote better 
cybersecurity practices going forward.*** In this white paper, CTA encourages public-private partnerships 
to develop and deploy risk-based approaches to cybersecurity,”*° and argues that “neither the new 
Administration nor Congress should embrace rules, product labels or certification regimes for consumer 
IoT.” They claim that “[c]ybersecurity mandates, pre-market ‘approval,’ and government certification 
or labeling of IoT devices are likely to require an enormous bureaucracy and have unintended 
consequences.””°! We seek comment on these views. Are there any gaps in the NIST IoT Report or other 
federal efforts to address IoT security that the Commission could help address? 


105. We recognize that consideration of how to incentivize cybersecurity best practices 
through our equipment authorization process aligns closely with the recently issued Executive Order 
14028, which directs NIST to work with the Federal Trade Commission and other agencies to develop a 
labeling program to identify specific IoT cybersecurity criteria and provide that information to 


256 RF fingerprinting involves the development of a unique identifier for a wireless device, similar to a biological 
fingerprint, to improve the security and privacy of wireless communication. IEEE.org, Radiofrequency 
Fingerprinting and its Challenges (last updated May 30, 2021). https://ieeexplore.ieee.org/document/6997522. 


257 See, e.g., Int’l Org. for Standardization & Int] Electrotechnical Comm’n Joint Tech. Comm. for Info. Tech. 
(ISO/IEC JTC 1), About Us (last visited June 10, 2021), https://jtclinfo.org/about/. 


258 Consumer Tech. Ass’n, Smart Policy to Secure our Smart Future: How to Promote a Secure Internet of Things 
for Consumers (Mar. 2021) (CTA Cybersecurity White Paper), https://www.cta.tech/Resources/Newsroom/Media- 
Releases/2021/March/IOT-Device-Security-White-Paper-Release. 


259 CTA Cybersecurity White Paper, at 2-3. 
260 CTA Cybersecurity White Paper, at 7-13. 
261 Td. at 8. 
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consumers.” While the Director of NIST has not yet identified the agencies that will participate in the 
forthcoming IoT cybersecurity labeling program, we seek comment on whether the Commission can 
support these efforts, either directly or indirectly. If so, how? 


IV. PROCEDURAL MATTERS 


106. Initial Regulatory Flexibility Analysis. As required by the Regulatory Flexibility Act of 
1980 (RFA),?% as amended (RFA), the Commission has prepared an Initial Regulatory Flexibility 
Analysis (IRFA) of the possible significant economic impact on a substantial number of small entities of 
the proposals addressed in this Notice of Proposed Rulemaking and Notice of Inquiry. The IRFA is 
found in Appendix B. Written public comments are requested on the IRFA. These comments must be 
filed in accordance with the same filing deadlines for comments on the Notice of Proposed Rulemaking 
and Notice of Inquiry, and they should have a separate and distinct heading designating them as responses 
to the IRFA. The Commission’s Consumer and Governmental Affairs Bureau, Reference Information 
Center, will send a copy of this Notice of Proposed Rulemaking and Notice of Inquiry, including the 
IRFA, to the Chief Counsel for Advocacy of the Small Business Administration, in accordance with the 
RF ‘A264 


107. Paperwork Reduction Act. This document contains proposed new or modified 
information collection requirements. The Commission, as part of its continuing effort to reduce 
paperwork burdens, invites the general public and the Office of Management and Budget (OMB) to 
comment on the information collection requirements contained in this document, as required by the 
Paperwork Reduction Act of 1995, Public Law 104-13.7¢ In addition, pursuant to the Small Business 
Paperwork Relief Act of 2002, Public Law 107-198,7% we seek specific comment on how we might 
further reduce the information collection burden for small business concerns with fewer than 25 
employees. 


108. Ex Parte Rules — Permit but Disclose. Pursuant to section 1.1200(a) of the Commission’s 
rules,” this Notice of Proposed Rulemaking and Notice of Inquiry shall be treated as a “permit-but- 
disclose” proceeding in accordance with the Commission’s ex parte rules.” Persons making ex parte 
presentations must file a copy of any written presentation or a memorandum summarizing any oral 
presentation within two business days after the presentation (unless a different deadline applicable to the 
Sunshine period applies). Persons making oral ex parte presentations are reminded that memoranda 
summarizing the presentation must (1) list all persons attending or otherwise participating in the meeting 
at which the ex parte presentation was made, and (2) summarize all data presented and arguments made 
during the presentation. If the presentation consisted in whole or in part of the presentation of data or 
arguments already reflected in the presenter’s written comments, memoranda or other filings in the 
proceeding, the presenter may provide citations to such data or arguments in his or her prior comments, 
memoranda, or other filings (specifying the relevant page and/or paragraph numbers where such data or 
arguments can be found) in lieu of summarizing them in the memorandum. Documents shown or given 
to Commission staff during ex parte meetings are deemed to be written ex parte presentations and must 
be filed consistent with rule 1.1206(b). In proceedings governed by rule 1.49(f) or for which the 
Commission has made available a method of electronic filing, written ex parte presentations and 


262 Exec. Order No. 14028, Executive Order on Improving the Nation’s Cybersecurity, 86 Fed. Reg. 26633, 26640- 
41, § 4(s)-(u) (May 17, 2021). 


263 See 5 U.S.C. § 603. 

264 See 5 U.S.C. § 603(a). 

265 44 U.S.C. §§ 3501-3520. 
266 See 44 U.S.C. § 3506(c)(4), 
267 47 CFR § 1.1200(a). 

268 47 CFR §§ 1.1200 et seq. 
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memoranda summarizing oral ex parte presentations, and all attachments thereto, must be filed through 
the electronic comment filing system available for that proceeding, and must be filed in their native 
format (e.g., .doc, .xml, .ppt, searchable .pdf). Participants in this proceeding should familiarize 
themselves with the Commission’s ex parte rules. 


109. | Comment Period and Filing Procedures. Pursuant to sections 1.415 and 1.419 of the 
Commission’s rules, 47 CFR §§ 1.415, 1.419, interested parties may file comments and reply comments 
on or before the dates indicated on the first page of this document. All filings must refer to ET Docket 
No. 21-232 and EA Docket No. 21-233. 


e Electronic filers: Comments may be filed electronically using the Internet by 
accessing the Commission’s Electronic Comment Filing System (ECFS): 
https://www.fec.gov/ecfs. See Electronic Filing of Documents in Rulemaking 
Proceedings, 63 FR 24121 (1998). 


e Paper Filers: Parties who choose to file by paper must file an original and one copy 
of each filing. 


o Filings can be sent by commercial overnight courier, or by first-class or 
overnight U.S. Postal Service mail. All filings must be addressed to the 
Commission’s Secretary, Office of the Secretary, Federal Communications 
Commission. 

o Commercial overnight mail (other than U.S. Postal Service Express Mail and 
Priority Mail) must be sent to 9050 Junction Drive, Annapolis Junction, MD 
20701. 

o USS. Postal Service first-class, Express, and Priority mail must be addressed 
to 45 L Street NE, Washington, DC 20554. 


¢ Effective March 19, 2020, and until further notice, the Commission no longer accepts 
any hand or messenger delivered filings. This is a temporary measure taken to help 
protect the health and safety of individuals, and to mitigate the transmission of 
COVID-19. See FCC Announces Closure of FCC Headquarters Open Window and 
Change in Hand-Delivery Policy, Public Notice, DA 20-304 (March 19, 2020). 
https://www.fec.gov/document/fcc-closes-headquarters-open-window-and-changes- 
hand-delivery-policy. 


110. People with Disabilities: To request materials in accessible formats for people with 
disabilities (braille, large print, electronic files, audio format), send an e-mail to fec504@fcc.gov or call 
the Consumer and Governmental Affairs Bureau at 202-418-0530 (voice), 202-418-0432 (tty). 


111. Availability of Documents: Comments, reply comments, and ex parte submissions will 
be publicly available online via ECFS.?® When the FCC Headquarters reopens to the public, these 
documents will also be available for public inspection during regular business hours in the FCC 
Reference Center, Federal Communications Commission, 45 L Street NE, Washington, DC 20554. 


112. Further Information. For further information, contact Jamie Coleman of the Office of 
Engineering and Technology, at 202-418-2705 or Jamie.Coleman@fcc.gov. 


V. ORDERING CLAUSES 


113. Accordingly, IT IS ORDERED, pursuant to the authority found in sections 4(i), 301, 302, 
303, 309(j), 312, and 316 of the Communications Act of 1934, as amended, 47 U.S.C. §§ 154(i), 301, 


269 Documents will generally be available electronically in ASCII, Microsoft Word, and/or Adobe Acrobat. 
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302a, 303, 309(j), 312, 316, and section 1.411 of the Commission’s Rules, 47 CFR § 1.411, that this 
Notice of Proposed Rulemaking and Notice of Inquiry IS HEREBY ADOPTED. 


114. IT IS FURTHER ORDERED that the Commission’s Consumer and Governmental 
Affairs Bureau, Reference Information Center, SHALL SEND a copy of this Notice of Proposed 
Rulemaking and Notice of Inquiry, including the Initial Regulatory Flexibility Analysis, to the Chief 
Counsel for Advocacy of the Small Business Administration. 


FEDERAL COMMUNICATIONS COMMISSION 


Marlene H. Dortch 
Secretary 
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APPENDIX A 


Proposed Rules 


For the reasons set forth in the preamble, the Federal Communications Commission amends part 2 of 
Title 47 of the Code of Federal Regulations as follows: 


Part 2 — FREQUENCY ALLOCATIONS AND RADIO TREATY MATTERS; GENERAL 
RULES AND REGULATIONS 


1. The authority citation for part 2 continues to read as follows: 
Authority: 47 U.S.C. 154, 302a, 303, and 336, unless otherwise noted. 
2; Add § 2.903 to subpart J to read as follows: 


§ 2.903 Prohibition on equipment authorization of equipment on the Covered List. 


Any equipment on the Covered List, as defined in § 1.50002 of this chapter, is prohibited from obtaining 
an equipment authorization under this subpart. This includes: 


(a) Equipment subject to certification procedures: Telecommunication Certification Bodies 
and the Federal Communications Commission are prohibited from issuing a certification under this 
subpart for any equipment on the Covered List; and 


(b) Equipment subject to Supplier’s Declaration of Conformity procedures. 
3. Amend § 2.906 by adding paragraph (c) to read as follows: 
§ 2.906 Declaration of Conformity. 
xok k k k 
(c) All equipment produced or provided by any of the entities, or their respective subsidiaries 


or affiliates, that produce or provide “covered” equipment on the Covered List established pursuant to § 
1.50002 of this chapter, is prohibited from obtaining equipment authorization through the Supplier’s 
Declaration of Conformity process. 


4. Amend § 2.907 by adding paragraph (c) to read as follows: 
§ 2.907 Certification. 
x ok k ok ok 
(c) All equipment produced or provided by any of the entities, or their respective subsidiaries 


or affiliates, that produce or provide “covered” equipment, as specified on the Covered List established 
pursuant to § 1.50002 of this chapter, must obtain equipment authorization through the certification 
process. 


5. Amend § 2.909 by revising paragraph (a) to read as follows: 
§ 2.909 Responsible Party. 


(a) For equipment that requires the issuance of a grant of certification, the party to whom that 
grant of certification is issued is responsible for the compliance of the equipment with the applicable 
standards. If the radio frequency equipment is modified by any party other than the grantee and that party 
is not working under the authorization of the grantee pursuant to § 2.929(b), the party performing the 
modification is responsible for compliance of the product with the applicable administrative and technical 
provisions in this chapter. In either case, the responsible party must be located in the United States (see § 
2.1033). 


x Ck ok ck ok 
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6. Amend § 2.911 by adding paragraph (d)(5) to read as follows: 
§ 2.911 Application requirements. 


x Ck ck ok ok 


(5) The applicant shall provide a written and signed certification that, as of the date of the 
filing of the application, the equipment for which the applicant seeks equipment authorization through 
certification is not “covered” equipment on the Covered List established pursuant to § 1.50002 of this 
chapter. 


x k ok ok ok 
7. Amend § 2.1033 by revising paragraph (b)(1) to read as follows: 
§ 2.1033 Application for Certification. 
x ok k k k 
(1) The identification, by name, mailing address and telephone number or Internet contact 


information, of the manufacturer of the device, the applicant for certification, and the responsible party as 
defined in § 2.909. The responsible party must be located within the United States. 


x ok k k k 
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APPENDIX B 
INITIAL REGULATORY FLEXIBILITY ANALYSIS 


1. As required by the Regulatory Flexibility Act of 1980, as amended (RFA),' the 
Commission has prepared this present Initial Regulatory Flexibility Analysis (IRFA) of the possible 
significant economic impact on a substantial number of small entities by the policies and rules proposed 
in this Notice of Proposed Rule Making (Notice). Written public comments are requested on this IRFA. 
Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments 
on the Notice, including this IRFA, to the Chief Counsel for Advocacy of the Small Business 
Administration (SBA).* In addition, the Notice and IRFA (or summaries thereof) will be published in the 
Federal Register. 


A. Need for, and Objectives of, the Proposed Rules 


2 In this Notice of Proposed Rulemaking, we propose prohibiting the authorization of any 
equipment on the list of equipment and services (Covered List) that the Commission maintains pursuant 
to the Secure and Trusted Communications Networks Act of 2019.4 Such equipment has been found to 
pose an unacceptable risk to the national security of the United States or the security and safety of United 
States persons. We also seek comment on whether and under what circumstances we should revoke any 
existing authorizations of such “covered” communications equipment. Finally, we invite comment on 
whether we should require additional certifications relating to national security from applicants who wish 
to participate in Commission auctions. 


B. Legal Basis 


3. The proposed action is taken under authority found in sections 4(i), 301, 302, 303, 309(), 
312, and 316 of the Communications Act of 1934, as amended, 47 U.S.C. §§ 154(i), 301, 302a, 303, 
309(j), 312 and 316; and section 1.411 of the Commission’s Rules, 47 CFR § 1.411. 


C. Description and Estimate of the Number of Small Entities to Which the Proposed 
Rules Will Apply 
4. The RFA directs agencies to provide a description of, and where feasible, an estimate of 


the number of small entities that may be affected by the proposed rules and policies, if adopted.> The 
RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” 
“small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has 
the same meaning has the term “small business concern” under the Small Business Act.’ A “small 


'5 U.S.C. § 603. The RFA, 5 U.S.C. § 601 — 612, has been amended by the Small Business Regulatory 
Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104-121, Title H, 110 Stat. 857 (1996). 


2 5 U.S.C. § 603(a). 
35 U.S.C. § 603(a). 


4 Secure and Trusted Communications Networks Act of 2019, Pub. L. No. 116-124, 133 Stat. 158 (2020) (codified 
as amended at 47 U.S.C. §§ 1601—1609) (Secure Networks Act). The Commission’s Public Safety and Homeland 
Security Bureau maintains the list at https://www.fcc.gov/supplychain/coveredlist. 


55 U.S.C. § 603(b)(3). 
65 U.S.C. § 601(6). 


75 U.S.C. § 601(3) (incorporating by reference the definition of “small-business concern” in the Small Business 
Act, 15 U.S.C. § 632). Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an 
agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity 
for public comment, establishes one or more definitions of such term which are appropriate to the activities of the 
agency and publishes such definition(s) in the Federal Register.” 
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business concern” is one which: (1) is independently owned and operated; (2) is not dominant in its field 
of operation; and (3) satisfies any additional criteria established by the SBA.® 


5. Small Businesses, Small Organizations, and Small Governmental Jurisdictions. Our 
actions, over time, may affect small entities that are not easily categorized at present. We therefore 
describe here, at the outset, three broad groups of small entities that could be directly affected herein.’ 
First, while there are industry specific size standards for small businesses that are used in the regulatory 
flexibility analysis, according to data from the Small Business Administration’s (SBA) Office of 
Advocacy, in general a small business is an independent business having fewer than 500 employees.!° 
These types of small businesses represent 99.9% of all businesses in the United States, which translates to 
30.7 million businesses.!! 


6. Next, the type of small entity described as a “small organization” is generally “any not- 
for-profit enterprise which is independently owned and operated and is not dominant in its field.”1? The 
Internal Revenue Service (IRS) uses a revenue benchmark of $50,000 or less to delineate its annual 
electronic filing requirements for small exempt organizations.'? Nationwide, for tax year 2018, there 
were approximately 571,709 small exempt organizations in the U.S. reporting revenues of $50,000 or less 
according to the registration and tax data for exempt organizations available from the IRS.4 


Te Finally, the small entity described as a “small governmental jurisdiction” is defined 
generally as “governments of cities, counties, towns, townships, villages, school districts, or special 
districts, with a population of less than fifty thousand.”!> U.S. Census Bureau data from the 2017 Census 
of Governments!* indicate that there were 90,075 local governmental jurisdictions consisting of general 
purpose governments and special purpose governments in the United States.!? Of this number there were 


8 15 U.S.C. § 632. 
9 See 5 U.S.C. § 601(3)-(6). 


10 See SBA, Office of Advocacy, “What’s New With Small Business?” https://cdn.advocacy.sba.gov/wp- 
content/uploads/2019/09/23172859/Whats-New-With-Small-Business-2019.pdf (Sept 2019). 


1 Jd, 
12 5 U.S.C. § 601(4). 


13 The IRS benchmark is similar to the population of less than 50,000 benchmark in 5 U.S.C § 601(5) that is used to 
define a small governmental jurisdiction. Therefore, the IRS benchmark has been used to estimate the number small 
organizations in this small entity description. See Annual Electronic Filing Requirement for Small Exempt 
Organizations — Form 990-N (e-Postcard), “Who must file,” 


https://www. irs. gov/charities-non-profits/annual-electronic-filing-requirement-for-small-exempt-organizations- 
form-990-n-e-postcard. We note that the IRS data does not provide information on whether a small exempt 
organization is independently owned and operated or dominant in its field. 


14 See Exempt Organizations Business Master File Extract (EO BMF), “CSV Files by Region,” 

https://www. irs. gov/charities-non-profits/exempt-organizations-business-master-file-extract-eo-bmf. The IRS 
Exempt Organization Business Master File (EO BMF) Extract provides information on all registered tax- 
exempt/non-profit organizations. The data utilized for purposes of this description was extracted from the IRS EO 
BMF data for Region 1-Northeast Area (76,886), Region 2-Mid-Atlantic and Great Lakes Areas (221,121), and 
Region 3-Gulf Coast and Pacific Coast Areas (273,702) which includes the continental U.S., Alaska, and Hawaii. 
This data does not include information for Puerto Rico. 


15 5 U.S.C. § 601(5). 


16 See 13 U.S.C. § 161. The Census of Governments survey is conducted every five (5) years compiling data for 
years ending with “2” and “7.” See also Census of Governments, https://www.census.gov/programs- 
surveys/cog/about.html. 


17 See U.S. Census Bureau, 2017 Census of Governments — Organization Table 2. Local Governments by Type and 
State: 2017 [CG17000RG02]. https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. Local 
(continued. ...) 
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36,931 general purpose governments (county!®, municipal and town or township!*) with populations of 
less than 50,000 and 12,040 special purpose governments - independent school districts*® with enrollment 
populations of less than 50,000.7! Accordingly, based on the 2017 U.S. Census of Governments data, we 
estimate that at least 48,971 entities fall into the category of “small governmental jurisdictions.” 


8. Satellite Telecommunications. This category comprises firms “primarily engaged in 
providing telecommunications services to other establishments in the telecommunications and 
broadcasting industries by forwarding and receiving communications signals via a system of satellites or 
reselling satellite telecommunications.”?> Satellite telecommunications service providers include satellite 
and earth station operators. The category has a small business size standard of $35 million or less in 
average annual receipts, under SBA rules.”4 For this category, U.S. Census Bureau data for 2012 show 
that there were a total of 333 firms that operated for the entire year.? Of this total, 299 firms had annual 
receipts of less than $25 million.” Consequently, we estimate that the majority of satellite 
telecommunications providers are small entities. 


9. All Other Telecommunications. The “All Other Telecommunications” category is 
comprised of establishments primarily engaged in providing specialized telecommunications services, 


governmental jurisdictions are made up of general purpose governments (county, municipal and town or township) 
and special purpose governments (special districts and independent school districts). See also Table 2. 
CG1700ORGO02 Table Notes_Local Governments by Type and State_2017. 


18 See id. at Table 5. County Governments by Population-Size Group and State: 2017 [CG1700ORG05]. 
https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. There were 2,105 county governments 
with populations less than 50,000. This category does not include subcounty (municipal and township) 
governments. 


'9 See id. at Table 6. Subcounty General-Purpose Governments by Population-Size Group and State: 2017 
[CG1700ORG06]. https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. There were 18,729 
municipal and 16,097 town and township governments with populations less than 50,000. 


20 See id. at Table 10. Elementary and Secondary School Systems by Enrollment-Size Group and State: 2017 
[CG1700O0RG10]. https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. There were 12,040 
independent school districts with enrollment populations less than 50,000. See also Table 4. Special-Purpose Local 
Governments by State Census Years 1942 to 2017 [CG1700ORG04], CG1700ORG04 Table Notes_Special Purpose 
Local Governments by State_Census Years 1942 to 2017. 


21 While the special purpose governments category also includes local special district governments, the 2017 Census 
of Governments data does not provide data aggregated based on population size for the special purpose governments 
category. Therefore, only data from independent school districts is included in the special purpose governments 
category. 


22 This total is derived from the sum of the number of general purpose governments (county, municipal and town or 
township) with populations of less than 50,000 (36,931) and the number of special purpose governments - 
independent school districts with enrollment populations of less than 50,000 (12,040), from the 2017 Census of 
Governments - Organizations Tables 5, 6, and 10. 


23 See U.S. Census Bureau, 2017 NAICS Definition, “517410 Satellite Telecommunications, ” 
https://www.census.gov/cgi-bin/sssd/naics/naicsrch?input=517410&search=2017+NAICS+Search&search=2017. 


4 See 13 CFR § 121.201, NAICS Code 517410. 


25 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ4, Information: 
Subject Series - Estab and Firm Size: Receipts Size of Firms for the U.S.: 2012, NAICS Code 517410, 
https://data.census.gov/cedsci/table?text=EC1251SSSZ4&n=517410&tid=ECNSIZE2012.EC1251SSSZ4&hidePrev 
iew=false&vintage=2012. 


26 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 
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such as satellite tracking, communications telemetry, and radar station operation.” This industry also 
includes establishments primarily engaged in providing satellite terminal stations and associated facilities 
connected with one or more terrestrial systems and capable of transmitting telecommunications to, and 
receiving telecommunications from, satellite systems.”* Establishments providing Internet services or 
voice over Internet protocol (VoIP) services via client-supplied telecommunications connections are also 
included in this industry.” The SBA has developed a small business size standard for “All Other 
Telecommunications”, which consists of all such firms with annual receipts of $35 million or less.3? For 
this category, U.S. Census Bureau data for 2012 show that there were 1,442 firms that operated for the 
entire year.*! Of those firms, a total of 1,400 had annual receipts less than $25 million and 15 firms had 
annual receipts of $25 million to $49, 999,999.*? Thus, the Commission estimates that the majority of 
“All Other Telecommunications” firms potentially affected by our action can be considered small. 


10. Fixed Satellite Transmit/Receive Earth Stations. There are approximately 4,303 earth 
station authorizations, a portion of which are Fixed Satellite Transmit/Receive Earth Stations. We do not 
request nor collect annual revenue information and are unable to estimate the number of the earth stations 
that would constitute a small business under the SBA definition. However, the majority of these stations 
could be impacted by our proposed rules. 


11. Fixed Satellite Small Transmit/Receive Earth Stations. There are approximately 
4,303 earth station authorizations, a portion of which are Fixed Satellite Small Transmit/Receive Earth 
Stations. We do not request nor collect annual revenue information and are unable to estimate the number 
of fixed small satellite transmit/receive earth stations that would constitute a small business under the 
SBA definition. However, the majority of these stations could be impacted by our proposed rules. 


12. Mobile Satellite Earth Stations. There are 19 licensees. We do not request nor collect 
annual revenue information and are unable to estimate the number of mobile satellite earth stations that 
would constitute a small business under the SBA definition. However, it is expected that many of these 
stations could be impacted by our proposed rules. 


13. Wireless Telecommunications Carriers (except satellite). This industry comprises 
establishments engaged in operating and maintaining switching and transmission facilities to provide 
communications via the airwaves. Establishments in this industry have spectrum licenses and provide 
services using that spectrum, such as cellular services, paging services, wireless internet access, and 
wireless video services.*? The appropriate size standard under SBA rules is that such a business is small 
if it has 1,500 or fewer employees.** For this industry, U.S. Census Bureau data for 2012 show that there 


27 See U.S. Census Bureau, 2017 NAICS Definition, “517919 All Other Telecommunications,” 
https://www.census.gov/naics/?input=5 179 19&year=2017&details=517919. 


28 Td. 
29 Td. 
30 See 13 CFR § 121.201, NAICS Code 517919. 


3! See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ4, Information: 
Subject Series - Estab and Firm Size: Receipts Size of Firms for the U.S.: 2012, NAICS Code 517919, 
https://data.census.gow/cedsci/table?text=EC 125 1SSSZ4&n=517919&tid=ECNSIZE2012.EC1251SSSZ4&hidePrev 
iew=false. 


32 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


33 See U.S. Census Bureau, 2017 NAICS Definition, “517312 Wireless Telecommunications Carriers (except 
Satellite), ” https://www.census.gov/naics/?input=5 173 12&year=2017&details=517312. 


34 See 13 CFR § 121.201, NAICS Code 517312 (previously 517210). 
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were 967 firms that operated for the entire year.*> Of this total, 955 firms employed fewer than 1,000 
employees and 12 firms employed of 1000 employees or more.*® Thus under this category and the 
associated size standard, the Commission estimates that the majority of Wireless Telecommunications 
Carriers (except Satellite) are small entities. 


14. Wireless Carriers and Service Providers. Neither the SBA nor the Commission has 
developed a size standard specifically applicable to Wireless Carriers and Service Providers. The closest 
applicable is Wireless Telecommunications Carriers (except Satellite)*’, which the SBA small business 
size standard is such a business is small if it 1,500 persons or less.38 For this industry, U.S. Census 
Bureau data for 2012 show that there were 967 firms that operated for the entire year.*? Of this total, 955 
firms had employment of 999 or fewer employees and 12 had employment of 1000 employees or more.*? 
Thus under this category and the associated size standard, the Commission estimates that the majority of 
Wireless Carriers and Service Providers are small entities. 


15. According to internally developed Commission data for all classes of Wireless Service 
Providers, there are 970 carriers that reported they were engaged in the provision of wireless services.“ 
Of this total, an estimated 815 have 1,500 or fewer employees, and 155 have more than 1,500 
employees. Thus, using available data, we estimate that the majority of Wireless Carriers and Service 
Providers can be considered small. 


16. Wired Telecommunications Carriers. The U.S. Census Bureau defines this industry as 
“establishments primarily engaged in operating and/or providing access to transmission facilities and 
infrastructure that they own and/or lease for the transmission of voice, data, text, sound, and video using 
wired communications networks. Transmission facilities may be based on a single technology or a 
combination of technologies. Establishments in this industry use the wired telecommunications network 
facilities that they operate to provide a variety of services, such as wired telephony services, including 
VoIP services, wired (cable) audio and video programming distribution, and wired broadband internet 
services. By exception, establishments providing satellite television distribution services using facilities 
and infrastructure that they operate are included in this industry.” The SBA has developed a small 
business size standard for Wired Telecommunications Carriers, which consists of all such companies 


35 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ5, Information: 
Subject Series: Estab and Firm Size: Employment Size of Firms for the U.S.: 2012, NAICS Code 517210, 
https://data.census.gov/cedsci/table?text=EC 125 1SSSZ5&n=517210&tid=ECNSIZE2012.EC1251SSSZ5&hidePrev 
iew=false&vintage=2012. 


36 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


37 See U.S. Census Bureau, 2017 NAICS Definition, “517312 Wireless Telecommunications Carriers (except 
Satellite), ” https://www.census.gov/naics/?input=5 173 12&year=2017&details=517312. 


38 See 13 CFR § 121.201, NAICS Code 517312 (previously 517210). 


39 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ5, Information: 
Subject Series: Estab and Firm Size: Employment Size of Firms for the U.S.: 2012, NAICS Code 517210, 
https://data.census.gov/cedsci/table?text=EC 125 1SSSZ5&n=517210&tid=ECNSIZE2012.EC1251SSSZ5&hidePrev 
iew=false&vintage=2012. 


40 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


41 See Federal Communications Commission, Wireline Competition Bureau, Industry Analysis and Technology 
Division, Trends in Telephone Service at Table 5.3 (Sept. 2010) (Trends in Telephone Service), 
https://apps.fec.gov/edocs_public/attachmatch/DOC-301823A1.pdf. 


2 See id. 


43 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,” 
https://www.census.gov/naics/?input=5 17311 &year=2017&details=517311. 
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having 1,500 or fewer employees.** U.S. Census Bureau data for 2012 show that there were 3,117 firms 
that operated that year.*5 Of this total, 3,083 operated with fewer than 1,000 employees.*® Thus, under 
this size standard, the majority of firms in this industry can be considered small. 


17. Licenses Assigned by Auctions. Initially, we note that, as a general matter, the number 
of winning bidders that qualify as small businesses at the close of an auction does not necessarily 
represent the number of small businesses currently in service. Also, the Commission does not generally 
track subsequent business size unless, in the context of assignments or transfers, unjust enrichment issues 
are implicated. 


18. Private Land Mobile Radio (“PLMR”). PLMR systems serve an essential role in a 
range of industrial, business, land transportation, and public safety activities. Companies of all sizes 
operating in all U.S. business categories use these radios. Because of the vast array of PLMR users, the 
Commission has not developed a small business size standard specifically applicable to PLMR users. 
The closest applicable SBA category is Wireless Telecommunications Carriers (except Satellite) which 
encompasses business entities engaged in radiotelephone communications.*” The appropriate size 
standard for this category under SBA rules is that such a business is small if it has 1,500 or fewer 
employees.*® For this industry, U.S. Census Bureau data for 2012 show that there were 967 firms that 
operated for the entire year.” Of this total, 955 firms had employment of 999 or fewer employees and 12 
had employment of 1000 employees or more. Thus under this category and the associated size standard, 
the Commission estimates that the majority of PLMR Licensees are small entities. 


19. According to the Commission’s records, a total of approximately 400,622 licenses 
comprise PLMR users.*! There are a total of approximately 3,577 PLMR licenses in the 4.9 GHz band;> 
19,359 PLMR licenses in the 800 MHz band;*3 and 3,374 licenses in the frequencies range 173.225 MHz 


44 See 13 CFR § 121.201, NAICS Code 517311 (previously 517110). 


45 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ5, Information: 
Subject Series - Estab & Firm Size: Employment Size of Firms for the U.S.: 2012, NAICS Code 517110, 
https://data.census.gov/cedsci/table?text=EC1251SSSZ5&n=517110&tid=ECNSIZE2012.EC1251SSSZ5&hidePrev 
iew=false. 


46 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


47 See U.S. Census Bureau, 2017 NAICS Definition, “517312 Wireless Telecommunications Carriers (except 
Satellite), ” https://www.census.gov/naics/?input=5 173 12&year=2017&details=517312. 


48 See 13 CFR § 121.201, NAICS Code 517312 (formerly 517210). 


4 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ5, Information: 
Subject Series: Estab and Firm Size: Employment Size of Firms for the U.S.: 2012, NAICS Code 517210, 
https://data.census.gov/cedsci/table?text=EC 125 1SSSZ5&n=517210&tid=ECNSIZE2012.EC1251SSSZ5&hidePrev 
iew=false&vintage=2012. 


50 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


5! This figure was derived from Commission licensing records as of September 19, 2016. Licensing numbers 
change on a daily basis. This does not indicate the number of licensees, as licensees may hold multiple licenses. 
There is no information currently available about the number of PLMR licensees that have fewer than 1,500 
employees. 


>? Based on an FCC Universal Licensing System search of September 18, 2020. Search parameters: Radio Service = 
PA — Public Safety 4940-4990 MHz Band; Authorization Type = Regular; Status = Active. 


53 Based on an FCC Universal Licensing System search of September 18, 2020. Search parameters: Radio Service = 
GB, GE, GF, GJ, GM, GO, GP, YB, YE, YF, YJ, YM, YO, YP, YX; Authorization Type = Regular; Status = 
Active. 
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to 173.375 MHz.** The Commission does not require PLMR licensees to disclose information about 
number of employees, and does not have information that could be used to determine how many PLMR 
licensees constitute small entities under this definition. The Commission however believes that a 
substantial number of PLMR licensees may be small entities despite the lack of specific information. 


20. Radio and Television Broadcasting and Wireless Communications Equipment 
Manufacturing. This industry comprises establishments primarily engaged in manufacturing radio and 
television broadcast and wireless communications equipment.°> Examples of products made by these 
establishments are: transmitting and receiving antennas, cable television equipment, GPS equipment, 
pagers, cellular phones, mobile communications equipment, and radio and television studio and 
broadcasting equipment.*° The SBA has established a small business size standard for this industry of 
1,250 employees or less.>’ U.S. Census Bureau data for 2012 show that 841 establishments operated in 
this industry in that year.** Of that number, 828 establishments operated with fewer than 1,000 
employees, 7 establishments operated with between 1,000 and 2,499 employees and 6 establishments 
operated with 2,500 or more employees.5® Based on this data, we conclude that a majority of 
manufacturers in this industry are small. 


21. Auxiliary Special Broadcast and Other Program Distribution Services. This service 
involves a variety of transmitters, generally used to relay broadcast programming to the public (through 
translator and booster stations) or within the program distribution chain (from a remote news gathering 
unit back to the station). Neither the SBA nor the Commission has developed a size standard applicable 
to broadcast auxiliary licensees. The closest applicable SBA category and small business size standard 
falls under two SBA categories - Radio Stations® and Television Broadcasting.®! The SBA size standard 
for Radio Stations is firms having $41.5 million or less in annual receipts. U.S. Census Bureau data for 
2012 show that 2,849 radio station firms operated during that year. Of that number, 2,806 firms 


54 This figure was derived from Commission licensing records as of August 16, 2013. Licensing numbers change 
daily. We do not expect this number to be significantly smaller today. This does not indicate the number of 
licensees, as licensees may hold multiple licenses. There is no information currently available about the number of 
licensees that have fewer than 1,500 employees. 


55 See U.S. Census Bureau, 2017 NAICS Definition, “334220 Radio and Television Broadcasting and Wireless 
Communications Equipment Manufacturing,” 
https://www.census.gov/naics/?input=334220&year=2017&details=334220. 


56 Id. 
57 See 13 CFR § 121.201, NAICS Code 334220. 


58 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1231SG2, Manufacturing: 
Summary Series: General Summary: Industry Statistics for Subsectors and Industries by Employment Size: 2012, 
NAICS Code 334220, 

https://data.census.gov/cedsci/table?text=EC 123 1SG2&n=334220&tid=ECNSIZE2012.EC1231SG2&hidePreview= 
false. 


5 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


60 See U.S. Census Bureau, 2017 NAICS Definition, “515112 Radio Stations,” 
https://www.census.gov/naics/?input=5 15112&year=2017&details=515112. 


61 See U.S. Census Bureau, 2017 NAICS Definition, “515120 Television Broadcasting,” 
https://www.census.gov/naics/?input=5 15120&year=2017&details=515120. 


6 See 13 CFR § 121.201, NAICS Code 515112. 


See U.S. Census Bureau, 20/2 Economic Census of the United States, Table ID: EC1251SSSZ4, Information: 
Subject Series — Estab and Firm Size: Receipts Size of Firms for the U.S.: 2012, NAICS Code 515112, 
https://data.census.gov/cedsci/table?text=EC 1251SSSZ4&n=515112&tid=ECNSIZE2012.EC1251SSSZ4&hidePrev 
iew=false. 
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operated with annual receipts of less than $25 million per year and 17 with annual receipts between $25 
million and $49,999,999 million.“ For Television Broadcasting the SBA small business size standard is 
such businesses having $41.5 million or less in annual receipts. U.S. Census Bureau data show that 751 
firms in this category operated in that year.® Of that number, 656 had annual receipts of $25,000,000 or 
less, 25 had annual receipts between $25,000,000 and $49,999,999 and 70 had annual receipts of 
$50,000,000 or more.® Accordingly, based on the U.S. Census Bureau data for Radio Stations and 
Television Broadcasting, the Commission estimates that the majority of Auxiliary, Special Broadcast and 
Other Program Distribution Services firms are small. 


22: Radio Frequency Equipment Manufacturers (RF Manufacturers). Neither the 
Commission nor the SBA has developed a small business size standard applicable to Radio Frequency 
Equipment Manufacturers (RF Manufacturers). There are several analogous SBA small entity categories 
applicable to RF Manufacturers—Fixed Microwave Services, Other Communications Equipment 
Manufacturing, and Radio and Television Broadcasting and Wireless Communications Equipment 
Manufacturing. A description of these small entity categories and the small business size standards under 
the SBA rules are detailed below. 


23. Other Communications Equipment Manufacturing. This industry comprises 
establishments primarily engaged in manufacturing communications equipment (except telephone 
apparatus, and radio and television broadcast, and wireless communications equipment).68 Examples of 
such manufacturing include fire detection and alarm systems manufacturing, Intercom systems and 
equipment manufacturing, and signals (e.g., highway, pedestrian, railway, traffic) manufacturing.” The 
SBA has established a size standard for this industry as all such firms having 750 or fewer employees.” 
U.S. Census Bureau data for 2012 show that 383 establishments operated in that year.”! Of that number, 
379 operated with fewer than 500 employees and 4 had 500 to 999 employees.” Based on this data, we 
conclude that the majority of Other Communications Equipment Manufacturers are small. 


64 Id. 
65 See 13 CFR § 121.201, NAICS Code 515120. 


66 See U.S. Census Bureau, 2012 Economic Census of the United States, Table ID: EC1251SSSZ4, Information: 
Subject Series — Estab and Firm Size: Receipts Size of Firms for the U.S.: 2012, NAICS Code 515120, 
https://data.census.gov/cedsci/table?text=EC1251SSSZ4&n=515120&tid=ECNSIZE2012.EC1251SSSZ4&hidePrev 
iew=false. 


67 Td. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard of annual receipts of $41.5 million or less. 


68 See U.S. Census Bureau, 2017 NAICS Definitions, “334290 Other Communications Equipment Manufacturing,” 
https://www.census.gov/cgi-bin/sssd/naics/naicsrch?input=334290&search=2017+NAICS+Search&search=2017. 


© Td. 
70 See 13 CFR 121.201, NAICS Code 334290. 


71 See U.S. Census Bureau, 20/2 Economic Census of the United States, Table ID: EC1231SG2, Manufacturing: 
Summary Series: General Summary: Industry Statistics for Subsectors and Industries by Employment Size: 2012, 
NAICS Code 334290, 

https://data.census.gov/cedsci/table?text=EC 123 1SG2&n=334290&tid=ECNSIZE2012.EC1231SG2&hidePreview= 
false&vintage=2012. 


72 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 


10630 


Federal Communications Commission FCC 21-73 


24. Fixed Microwave Services. Microwave services include common carrier,” private- 
operational fixed,”* and broadcast auxiliary radio services.” They also include the Upper Microwave 
Flexible Use Service”, Millimeter Wave Service”, Local Multipoint Distribution Service (LMDS),’* the 
Digital Electronic Message Service (DEMS),” and the 24 GHz Service, where licensees can choose 
between common carrier and non-common carrier status.’! There are approximately 66,680 common 
carrier fixed licensees, 69,360 private and public safety operational-fixed licensees, 20,150 broadcast 
auxiliary radio licensees, 411 LMDS licenses, 33 24 GHz DEMS licenses, 777 39 GHz licenses, and five 
24 GHz licenses, and 467 Millimeter Wave licenses in the microwave services. The Commission has 
not yet defined a small business with respect to microwave services. The closest applicable SBA 
category is Wireless Telecommunications Carriers (except Satellite)*? and the appropriate size standard 
for this category under SBA rules is that such a business is small if it has 1,500 or fewer employees.** For 
this industry, U.S. Census Bureau data for 2012 show that there were 967 firms that operated for the 
entire year. Of this total, 955 firms had employment of 999 or fewer employees and 12 had 
employment of 1000 employees or more.** Thus under this SBA category and the associated size 
standard, the Commission estimates that a majority of fixed microwave service licensees can be 
considered small. 


25: The Commission does not have data specifying the number of these licensees that have 
more than 1,500 employees, and thus is unable at this time to estimate with greater precision the number 
of fixed microwave service licensees that would qualify as small business concerns under the SBA’s 
small business size standard. Consequently, the Commission estimates that there are up to 36,708 
common carrier fixed licensees and up to 59,291 private operational-fixed licensees and broadcast 
auxiliary radio licensees in the microwave services that may be small and may be affected by the rules 


® See 47 CFR Part 101, Subparts C and I. 
74 See 47 CFR Part 101, Subparts C and H. 


™ Auxiliary Microwave Service is governed by Part 74 of Title 47 of the Commission’s Rules. See 47 CFR Part 74. 
Available to licensees of broadcast stations and to broadcast and cable network entities, broadcast auxiliary 
microwave stations are used for relaying broadcast television signals from the studio to the transmitter, or between 
two points such as a main studio and an auxiliary studio. The service also includes mobile TV pickups, which relay 
signals from a remote location back to the studio. 


76 See 47 CFR Part 30. 

77 See 47 CFR Part 101, Subpart Q. 

78 See 47 CFR Part 101, Subpart L. 

7 See 47 CFR Part 101, Subpart G. 

80 See id. 

81 See 47 CFR §§ 101.533, 101.1017. 

82 These statistics are based on a review of the Universal Licensing System on September 22, 2015. 


83 See U.S. Census Bureau, 2017 NAICS Definition, “517312 Wireless Telecommunications Carriers (except 
Satellite)”, https://www.census. gov/cgi-bin/sssd/naics/naicsrch?code=5 173 12&search=2017%20NAICS%20Search. 


84 See 13 CFR § 121.201, NAICS Code 517312 (previously 517210). 


85 See U.S. Census Bureau, 20/2 Economic Census of the United States, Table ID: EC1251SSSZ5, Information: 
Subject Series, Estab and Firm Size: Employment Size of Firms for the U.S.: 2012, NAICS Code 517210, 
https://data.census.gow/cedsci/table?text=EC1251SSSZ5&n=517210&tid=ECNSIZE2012.EC1251SSSZ5&hidePrev 
iew=false&vintage=2012. 


86 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that 
meet the SBA size standard. 
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and policies discussed herein. We note, however, that the microwave fixed licensee category includes 
some large entities. 


D. Description of Projected Reporting, Recordkeeping, and Other Compliance 
Requirements for Small Entities 


26. The proposals being made in this Notice may require additional analysis and mitigation 
activities to the part 2 rules that include various provisions to help ensure the integrity of the equipment 
authorization process. The Commission is authorized to dismiss or deny an application where that 
application is not in accordance with Commission requirements or the Commission is unable to make the 
finding that grant of the application would serve the public interest. The rules also require the TCB to 
perform “post market surveillance” of equipment that has been certified, with guidance from OET, as 
may be appropriate. 


2T The Supplier’s Declaration of Conformity (SDoC) process is available with respect to 
certain types of RF devices that have less potential to cause interference. The SDoC procedure requires 
the party responsible for compliance (“responsible party”) to make the necessary measurements and 
complete other procedures found acceptable to the Commission to ensure that the particular equipment 
complies with the appropriate technical standards for that device. At this time, the Commission’s current 
equipment authorization rules do not include specific provisions addressing the “covered” equipment on 
the Covered List. This Covered List identifies communications equipment and services that pose an 
unacceptable risk to the national security of the United States or the security and safety of United States 
persons. The Commission is required to include communications equipment and services on the list 
based exclusively on determinations made by Congress and by other U.S. government agencies. 
Currently, the list includes equipment and services produced or provided by five entities. 


28. In this Notice we examine our rules relating to equipment authorization and participation 
in Commission auctions to help advance the Commission’s goal of protecting national security and public 
safety. This builds on other actions the Commission recently has taken to protect and secure our nation’s 
communications systems. 


E. Steps Taken to Minimize the Significant Economic Impact on Small Entities, and 
Significant Alternatives Considered 


29. The RFA requires an agency to describe any significant, specifically small business, 
alternatives that it has considered in reaching its proposed approach, which may include the following 
four alternatives (among others): “(1) the establishment of differing compliance or reporting requirements 
or timetables that take into account the resources available to small entities; (2) the clarification, 
consolidation, or simplification of compliance or reporting requirements under the rule for such small 
entities; (3) the use of performance rather than design standards; and (4) an exemption from coverage of 
the rule, or any part thereof, for such small entities.”®’ In this proceeding, our proposals are consistent 
with (2), in that our goal is to seek comment on various steps that the Commission could take in its 
equipment authorization program, as well as its competitive bidding program, to reduce threats posed to 
our nation’s communications system by “covered” equipment and services on the Covered List. We also 
seek comment on whether the Commission should revoke equipment authorizations of “covered” 
equipment, and if so under what conditions and procedures. 


F. Federal Rules that May Duplicate, Overlap, or Conflict with the Proposed Rules 
30. None. 


87 5 U.S.C. § 603(c). 
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STATEMENT OF 
ACTING CHAIRWOMAN JESSICA ROSENWORCEL 


Re: Protecting Against National Security Threats to the Communications Supply Chain through the 
Equipment Authorization Program, ET Docket No. 21-232; Protecting Against National Security 
Threats to the Communications Supply Chain through the Competitive Bidding Program, EA 
Docket No. 21-233. 


Our 5G future is about connecting everything. It is about moving to a new networked world that 
will open up possibilities for communications that we cannot even fully imagine today. By exponentially 
increasing the connections between people and things around us, this technology could become an input 
in everything we do—improving agriculture, education, healthcare, energy, transportation, and more. The 
data we derive from all these connections is powerful. It will inform machine learning, artificial 
intelligence, and the next generation of innovation across the economy. 


But to get there from here requires us to rethink our communications supply chain. That’s 
because insecure network equipment can undermine our 5G future, providing foreign actors with access 
to our communications. This, in turn, may mean the ability to inject viruses and malware in our network 
traffic, steal private data, engage in intellectual property theft, and surveil companies and government 
agencies. 


To address this risk, the Federal Communications Commission is now pursuing a proactive, 
three-pronged strategy to build a more secure and resilient communications supply chain for our 5G 
future. We are taking direct action to exclude untrusted equipment and vendors from communications 
networks both at home and abroad. We are recognizing that “Just Say No” is not a strategy, so we are 
moving fast to speed the way for trustworthy innovation. We are also engaged in a multifaced effort 
across government, with industry, and with partner nations to protect our networks from threats. 


Today, I am pleased that we are kicking off a rulemaking and inquiry that will spark new progress 
on each of these three lines of effort. 


First, we consider new measures to exclude untrustworthy equipment from our 
communications networks. To date, the FCC has prohibited the use of support from our universal 
service fund to purchase equipment that could pose a national security threat to the United States. Under 
the law, this includes communications equipment and services from Huawei, ZTE, Hytera, Hikvision, and 
Dahua. Thanks to the Secure and Trusted Communications Networks Act and a $1.9 billion 
appropriation from Congress, we also are putting the finishing touches on a program to replace insecure 
network equipment from these vendors to the extent that it is present in our domestic networks today. At 
the same time, we’ve taken action to ensure that foreign telecommunications companies that obtain or 
seek access to the market in the United States do not present a national security threat. 


So far, so good. But today we go further. Because it does not make sense to have these bans in 
place but leave open other opportunities for this equipment to reach our markets and be present in our 
networks. Yet that is exactly the state of our rules today. Despite having identified security concerns 
with telecommunications equipment from Huawei and ZTE back in 2019, for the last several years this 
agency has continued to put its stamp of approval on this equipment. In other words, we have left open 
opportunities for its use in the United States through our equipment authorization process. So here we 
propose to close that door. 


This is common sense. It will better align our equipment authorization procedures with our 
national security policies. It means the FCC would no longer approve equipment that is identified under 
the Secure and Trusted Communications Networks Act as posing an unacceptable risk to the national 
security of the United States or the safety of United States persons. To round this effort out, we also seek 
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comment on a number of other proposals designed to ensure that insecure equipment is not present in our 
networks. 


Second, we continue to speed the way for trustworthy innovation. By reducing our dependence 
on network components developed by untrusted vendors, we send a strong signal that the United States is 
committed to developing a market for secure 5G equipment alternatives. To this end, our ongoing work 
to foster the development of open radio access networks is important. Because if we do this right we will 
have a renewed opportunity for American technology leadership, more competition, better economic 
security, more resiliency in our supply chains, and improved ability to protect the privacy and data of 
citizens. 


Thanks to my colleague Commissioner Starks, we also ask questions about how the United States 
participates in standards-setting organizations. These bodies can play a big role in shaping the growth of 
future technologies. That means it is in our national interest to ensure that these organizations operate in 
a fair, impartial, balanced, and consensus-based manner and in accordance with fundamental rules of due 
process. That is why I have made the FCC’s participation a priority—to ensure that we are contributing 
our technical expertise and keeping our innovative edge. In fact, under my leadership, I am pleased to 
announce that the FCC has increased the number of our staff dedicated to standards development issues 
by more than 50 percent. I believe it is imperative that the United States government invest the resources 
necessary to lead in these processes because when we do we lead the world by example. 


Third, we explore how we can advance a multifaceted, strategic approach to protect our 
networks from all threats. The United States had 65,000 ransomware attacks last year. If you do the 
math, that is seven every hour. One recent attack shut down a key pipeline and emptied many gas stations 
across the Southeast. Another attack raised fears about the domestic beef supply. What started as a 
nuisance has quickly become a national security problem as cybercriminals target key parts of our 
infrastructure. 


These events remind us that we need to think about security in everything we do in our connected 
world. As part of this effort, we need to acknowledge that the equipment that connects to our networks is 
just as consequential for our national security as the equipment that goes into our networks. That means 
focusing on network equipment and supply chain security is not enough. We also need to focus on the 
security of the connected things—otherwise known as the Internet of Things. 


That is why in our inquiry today we ask questions about how we can leverage our equipment 
authorization procedures to encourage device manufacturers to build security into new connected 
products. We ask how we can build on existing efforts at the National Institute of Standards and 
Technology or elsewhere to do it. The time to have this discussion is now—because our cybersecurity 
challenges will only grow as connections multiply and the Internet of Things expands. 


I look forward to the record that develops. The policies we propose and the questions we ask are 
a big step toward renewing trust in our communications networks and trust in our equipment 
authorization system. They demonstrate that the FCC is committed to doing everything we can, together 
with our federal partners, to support the security of our communications networks. Our proposals also 
would implement the provisions of the Secure Equipment Act of 2021, and I thank Senator Markey, 
Senator Rubio, Congresswoman Eshoo, and House Republican Whip Steve Scalise for their leadership on 
these issues. 


Thank you also to the staff that worked on this effort, including Brian Butler, Jamie Coleman, 
Martin Doczkat, Howard Griboff, Michael Ha, Ira Keltz, Muli Kifle, Paul Murray, Siobahn Philemon, 
Jamison Prime, Ron Repasi, Dana Shaffer, Rodney Small, Tom Struble, Jim Szeliga, George Tannahill, 
Alfonso Tarditi, Dusmantha Tennakoon, and Ron Williams from the Office of Engineering and 
Technology; Jonathan Campbell, Giulia McHenry, Chuck Needy, Erik Salovaara, Michelle Schaefer, 
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Deena Shetler, and Emily Talaga from the Office of Economics and Analytics; Matthew Dunne, David 
Horowitz, Doug Klein, Jacob Lewis, and Bill Richardson from the Office of General Counsel; Gabriel 
Collazo, Jeffrey Gee, Pamela Kane, Chris Killion, Jason Koslofsky, Shannon Lipp, Jeremy Marcus, Neil 
McNeil, Elizabeth Mumaw, Phillip Rosario, Raphael Sznajder, and Ashley Tyson from the Enforcement 
Bureau; Denise Coca, Thomas Sullivan, and Kathy O’Brien from the International Bureau; Ronald 
Cunningham, Debra Jordan, Lauren Kravetz, Nikki McGinnis, Zenji Nakazawa, and Austin Randazzo 
from the Public Safety and Homeland Security Bureau; Brian Cruikshank, Elizabeth Cuttner, and Justin 
Faulb from the Wireline Competition Bureau; Jessica Greffenius, Kari Hicks, Charles Mathias, and Joel 
Taubenblatt from the Wireless Telecommunications Bureau; and Maura McGowan from the Office of 
Communications Business Opportunities. 


10635 


Federal Communications Commission FCC 21-73 


STATEMENT OF 
COMMISSIONER BRENDAN CARR 


Re: Protecting Against National Security Threats to the Communications Supply Chain through the 
Equipment Authorization Program, ET Docket No. 21-232; Protecting Against National Security 
Threats to the Communications Supply Chain through the Competitive Bidding Program, EA 
Docket No. 21-233. 


In 2019, I had the privilege of visiting Malmstrom Air Force Base near Great Falls, Montana. I 
spent time there with Colonel Jennifer Reeves who is Commander of the 341st Missile Wing. Colonel 
Reeves and her team have one of the most significant and weighty missions in government. In their 
charge are 150 intercontinental ballistic missiles loaded in underground silos spread across northern 
Montana. These are missiles that when launched can carry nuclear warheads almost 10,000 miles. 
Colonel Reeves told me that her job is to make sure they’re always ready to go. Set against that 
destructive power is a completely serene and wide-open landscape—it’s just wheat fields and Big Sky 
Country. Except, as it turns out, there are cell towers all around the Montana missile fields running on 
Huawei equipment. 


By now, I scarcely need to explain why the presence of Chinese-state backed communications 
equipment operating near American missile silos is concerning. Indeed, it is easy to understand that the 
Chinese government would value direct access to our telecom networks for reasons contrary to our 
security interests and our democratic values. 


Thankfully, the United States has taken decisive actions to protect Americans from threats posed 
by entities owned or controlled by Communist China. In 2018, Congress placed a ban on the use of 
federal funding to purchase this untrustworthy equipment through the National Defense Authorization 
Act. That same year, I worked with my colleagues to expand the scope of the FCC’s network security 
Notice of Proposed Rulemaking to put additional options on the table, including the removal of covered 
equipment—or as it has come to be known, rip and replace. And just last year, the FCC adopted rules for 
that rip and replace effort. In doing so, we also established the FCC’s Covered List to designate entities 
that pose an unacceptable risk to our national security. So far, we’ve determined five companies— 
Huawei, ZTE, Hytera, Hikvision, and Dahua—meet this threshold. 


Although our rip and replace requirement is a significant step towards strengthening our national 
security, it is limited to gear that is funded through our Universal Service Fund. The FCC’s rules 
expressly allow the continued installation of this equipment, so long as federal dollars are not involved. 
This is a glaring loophole, and one that Huawei and others are using today. It is the presence of this 
insecure equipment in our equipment that is the threat, not the source of funding used to purchase it. Yet 
the FCC, through its equipment authorization process, continues to approve for use in the U.S. thousands 
of applications from Huawei and other entities deemed national security threats. The FCC has approved 
more than 3,000 applications from Huawei alone since 2018. And just this month, the FCC approved 
applications from Hytera Communications. 


Once an entity lands on our Covered List, there appears to be no reason why the FCC should 
continue to review its gear and offer the FCC’s seal of approval. Taking this step, as I first proposed in 
2019 and then expanded on in March of this year, will strengthen our national security by preventing the 
further installation and use of insecure technology in our networks. 


So I want to thank Acting Chairwoman Rosenworcel for her leadership on this national security 


issue. I am pleased we are taking meaningful action towards closing this loophole. Indeed, the rules we 
propose are simple: equipment from entities that pose a national security risk will no longer be eligible 
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for FCC approval. We also seek comment on ways to ensure compliance with these rules and on the 
enforcement tools that may be appropriate for those who fail to live up to them. 


We are launching this proceeding with a simple and important goal in mind—to protect 
America’s communications networks and, in turn, our national security. But at the same time, this is also 
about what I have described as our “SG values”—values that Communist China clearly does not share 
with the United States or other democratic nations around the world. I am pleased that my FCC 
colleagues and I are working together to ensure that the companies supplying equipment integral to our 
networks are ones we can trust, and are ones that share our commitment to transparency, rule of law, and 
human rights. 


I am also encouraged that bipartisan, bicameral legislation, known as the “Secure Equipment 
Act,” has been introduced by Senator Marco Rubio, Senator Ed Markey, House Republican Whip Steve 
Scalise, and Congresswoman Anna Eshoo. The Secure Equipment Act recognizes the urgent need for the 
Commission to secure our networks through this proceeding and I commend these Members of Congress 
for their bold leadership. 


I would like to thank Acting Chairwoman Rosenworcel again for bringing this item forward and 
to my colleagues for their work on it. 


Finally, I want to express my thanks to staff in the Office of Engineering and Technology and the 
Public Safety and Homeland Security Bureau for their work in preparing this item. It has my support. 
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STATEMENT OF 
COMMISSIONER GEOFFREY STARKS 


Re: Protecting Against National Security Threats to the Communications Supply Chain through the 
Equipment Authorization Program, ET Docket No. 21-232; Protecting Against National Security 
Threats to the Communications Supply Chain through the Competitive Bidding Program, EA 
Docket No. 21-233. 


As each day seems to bring news of another cyber-attack on our government or critical 
infrastructure, it has never been truer to say: “network security is national security.” The Commission has 
assumed a critical role in this fight on several fronts. To protect the integrity of our telecommunications 
and information technology supply chain, we first prohibited the use of Universal Service Funding to 
purchase or support equipment or services posing a national security threat, then strategized a 
reimbursement plan to cover the cost of replacing the equipment already in U.S. networks. We’ve 
initiated proceedings to deny or revoke the US-operating authority of several foreign carriers that present 
a similar national security threat. I’ve also personally raised and focused questions about how to protect 
the vital communications on undersea cables and the possible threat posed by foreign-owned data centers. 
Today’s proceeding continues these efforts by proposing to bar FCC authorizations for devices from 
entities deemed to present a national security risk. Congress has charged us with prohibiting 
untrustworthy entities from operating in U.S. networks—we shouldn’t authorize equipment from those 
same entities for use here. 


Back in 2019, I called for the Commission to examine its equipment authorization authority as a 
possible tool for improving our network security. Since then, I’ve repeatedly highlighted the need to 
secure our supply chain, particularly with respect to devices originating overseas. I'm therefore glad that 
we’re moving forward with these proposed rules and I look forward to the public comments. While I 
recognize that the issues are complex, we cannot continue to authorize, import, and use equipment from 
companies deemed to present a national security threat. 


In particular, I want to thank my colleagues for agreeing to three of my edits to the circulated 
draft. As a former enforcement official, I’ve seen first-hand how implementation of federal policy can be 
much more challenging than the initial policymaking itself. My edits therefore focused on issues 
following adoption of any rules and addressing the broader issue of international supply chain security. 


First, if you sell your equipment in the United States—the greatest free marketplace in the 
world—then you should also make yourself readily available to the FCC’s jurisdiction should we need to 
ask questions or hold you accountable for any issues stemming from that equipment. The American 
people welcome competition for the best goods, but also expect to be protected from harm. It is only fair. 
The item therefore proposes to require foreign equipment authorization applicants to have a U.S. 
registered agent for service of process. The Commission’s staff works hard to identify and prosecute the 
marketing and use of unlawful equipment. Without proper service of process, however, those actions 
have no real consequences. I’ll briefly discuss two examples illustrating this point. 


In 2011, the Enforcement Bureau released a Hearing Designation Order for the Shenzhen 
Tangreat Technology Company based on evidence that Shenzhen had misrepresented the nature of its 
equipment when it applied for an FCC certification. While the company had told the FCC that its device 
was a “text stopper” intended to prevent texting while driving, the equipment actually operated as a 
jamming device, blocking cell phone signals well beyond the user’s vehicle. Jammers, of course, impede 
authorized communications, interfere with legitimate spectrum users’ rights, and jeopardize public safety. 
The Bureau ordered Shenzen to pay a forfeiture of more than $112,000 and to show cause why the 
Commission shouldn’t revoke its equipment authorization. 


Likewise, in 2014, the Commission found that the C.T.S. Technology Company had spent over 
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two years illegally marketing nearly 300 models of signal jamming devices to American consumers. 
These included devices capable of blocking wireless signals from nearly a mile away. While C.T.S.’s 
devices had never obtained any equipment authorizations, the Commission proposed a significant penalty 
because of the egregiousness of the violations, levying a $34.9 million fine against the firm. 


Years later, these cases have gone nowhere. Both Shenzen and C.T.S. are Chinese companies, 
and because neither firm has a U.S. agent for service of process, the Commission had to attempt service 
for both companies in China. Despite multiple attempts that included hiring translators, following the 
Hague Service Convention procedures, and contracting with Chinese service providers, the Commission 
has yet to actually complete service on either company. As a result, Shenzen’s jamming device retains its 
FCC authorization, although its use remains illegal. And C.T.S. has not paid one cent to the US Treasury 
and probably never will. 


That’s not right. We need to fix this. Our proposed rules could result in an unprecedented 
number of proceedings to revoke equipment authorizations from the covered entities. Without policy 
changes, any enforcement action against these companies will undoubtedly repeat our experience with 
C.T.S. and Shenzen. Therefore, the NPRM proposes to require future foreign-based equipment 
authorization applicants to include a U.S. registered agent and asks whether this requirement should apply 
to all existing equipment authorizations. Relatedly, we also propose that each device submitted for FCC 
certification include a “responsible party” within the United States charged with ensuring compliance 
with our rules, consistent with our practice for Suppliers’ Declarations of Conformity. 


Beyond all the legalese, the point is this: if your equipment harms Americans, the FCC needs to 
be able to find you, and hold you accountable. These changes will hopefully increase transparency, and 
prevent future bad actors from using their foreign status to avoid any FCC accountability. 


The implementation challenges aren’t just about enforcement against foreign entities. While the 
key players in our equipment authorization process may closely follow any FCC rule changes, these 
proposals will also affect devices already in the stream of commerce or the hands of end users who may 
be unaware of our rules. My second edit therefore added language asking how we can educate the public 
about any changes in our equipment authorization rules resulting from this proceeding. Effective 
education will increase the likelihood of compliance by retailers, consumers, and others. We also seek 
comment on whether our enforcement procedures can be integrated into a consumer education effort and 
whether transition periods for the effective date of our rules and any enforcement may increase awareness 
and compliance. 


Third, the item now asks how retailers can aid us in protecting the integrity of the U.S. network 
and supply chain. As I’ve noted before, even with broad adoption of industry best practices, some 
equipment sold in the United States may lack appropriate security protections. This is particularly likely 
with the inexpensive equipment sold on large websites that may be most popular with small businesses 
and consumers. Retailers can help protect our network security by voluntarily limiting the sale of such 
equipment and educating consumers about the importance of security protections for all their devices. 


Finally, the revised item now asks for comment about the status of international supply chain 
security standards and how we can encourage greater U.S. participation in these efforts. Our economy 
relies on supply chains that stretch all around the world. End users expect that their devices are secure, 
regardless of where those devices, or their parts, originate. International standards not only provide that 
assurance but also increase product quality, reduce costs, and ensure a common understanding that allows 
manufacturers and developers to create new products that benefit consumers. For example, since 1987, 
the joint technical committee of the International Organization for Standardization and the International 
Electrotechnical Commission has developed international standards in the field of information and 
communications technology, including standards which increased network security. 
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But China has attempted to usurp international standard setting organizations to establish 
economic and geopolitical power rather than enshrine the best technological approach. According to a 
December 2020 report from the Congressionally chartered US-China Economic and Security Review 
Commission, “[t]he Chinese government views technical standards as a policy tool to advance its 
economic and geopolitical interests. It has systematically tried to expand its influence in international 
standards-setting organizations by installing Chinese nationals in key leadership and functionary positions 
and pushing standards backed by its industrial policies.” That should raise all of our eyebrows. Given 
China’s focus on undermining the security of the U.S. and other countries, allowing it to dominate supply 
chain security standards could not only provide its companies with an economic edge but could also result 
in the incorporation of vulnerabilities for exploitation on an industry-wide basis. I say again, that’s not 
right. We need to fix this. 


Industry-led international supply chain security standards are welcome, but we must have active 
participation in these organizations by representatives from the U.S. and other countries that share our 
most important values. Greater participation on security and other issues will ensure that these bodies 
continue to adhere to their highest goal—that final standards reflect the best engineering and security 
judgments, and support the best technical outcomes. I encourage companies, universities, and other 
organizations to support greater participation and leadership in these bodies. 


This proceeding opens up another important front in the Commission’s work to protect our 


national security. I look forward to continuing to work on these issues and thank OET and the other 
Bureaus and Offices for their hard work on this item. 
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STATEMENT OF COMMISSIONER NATHAN SIMINGTON 


Re: Protecting Against National Security Threats to the Communications Supply Chain through the 
Equipment Authorization Program, ET Docket No. 21-232; Protecting Against National Security 
Threats to the Communications Supply Chain through the Competitive Bidding Program, EA 
Docket No. 21-233. 


The Notice of Proposed Rulemaking and Notice of Inquiry we adopt today ask exactly the right 
questions. These items will assist us in working out a precise and carefully tailored extension of the 
present legal and regulatory framework, thus further reducing security threats to the nation’s 
communication networks. The information we seek today ensures that our evolving framework permits 
the Commission to eliminate more security threats without disrupting, or placing unnecessary burdens 
upon, the communications supply chain and equipment industry. It’s straightforward: neither 
communications equipment, nor financial support for auction applicants, should be funded by any entity 
that the Commission has designated as a danger to our country’s national security. There is a broad social 
consensus that we must take action. And so, I support taking a close look at how the Commission can 
expand the scope of these defensive measures beyond our universal service programs. 


I also thank the Acting Chairwoman and my fellow commissioners for supporting my suggestion 
that, as part of the Notice of Inquiry, we take a close look at how radiofrequency (or RF) fingerprinting 
technology can play a central role in interdiction and enforcement of hacking and cyber-crime. RF 
fingerprinting uniquely identifies an individual wireless device, similar to the unique identification 
enabled by a human fingerprint. If we can identify specific devices involved in malfeasance, we can 
protect the security and privacy of wireless communications in an era of ever-increasing threats. 
Adopting an RF identification approach can also help manufacturers wishing to compete on the basis of 
superior security. The use of techniques such as RF fingerprinting could, for example, serve to 
demonstrate that a given manufacturer has taken action to mitigate security risks. Implementations of 
these technologies have matured significantly since the Commission last considered them and they are 
due for another look. 


I'm pleased to vote to support this item and express my gratitude to the Commission staff for all 
of their diligent work. 
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